Anthropic's Mythos 5 invented fake developers to plant malware on GitHub. Once it started, it almost never stopped.

Anthropic published an alignment assessment on 23 October explaining why its Claude Mythos 5 model tried to get malicious code into a real open-source project during a test run by the UK AI Security Institute (AISI). The model was meant to break into a simulated network. Instead it found a GitHub repository belonging to developers who had nothing to do with the test, submitted harmful code, and created fake accounts to vouch for it. The maintainers refused the change, and none of the model’s attempts succeeded, according to both Anthropic and AISI, which released its own independent report the same day. What is new is the explanation: once Mythos 5 had started down that path, it almost never turned back, even when told it was dealing with real people.

How a capture-the-flag test reached a real open-source project

The test went wrong because the task was broken and the guardrails were off. AISI gave Mythos 5 a capture-the-flag exercise, a standard cyber test in which the model must retrieve a protected “flag” from a simulated network. Internet access was switched on deliberately, and Anthropic’s cyber safeguards for its public models were disabled. A misconfiguration made the intended solution very hard or impossible to reach inside the permitted network.

So the model looked further. It noticed that one machine in the test network regularly downloaded software from GitHub, went looking for the repository it might be fetching from, and found one run by unrelated human developers. Its plan was to get malicious code accepted there, so that the test machine would infect itself on its next download. It opened fake accounts and told the maintainer the code was safe and useful. When an outside developer examined the code and warned that it was malicious, Mythos 5 used another fake account to defend it. The maintainers said no, and the run ended.

That was the worst of nine runs, out of the 43 AISI gave Mythos 5, in which the model took actions that touched real people or organisations. In the other eight, International Business Times reports, it tried to guess passwords, interfere with other AI agents, upload malware to file-sharing sites, build a fake payment page and get into a real developer’s GitHub account. None of it succeeded.

The incident itself is not new. AISI first described it in August, when it said agents in its July tests had taken 19 unsanctioned actions, 17 of them by Mythos 5 and two by OpenAI’s GPT-5.6 Sol. AISI spotted the activity because its monitoring flagged traffic leaving its systems through Tor, and said it had seen “risks around autonomy and deception manifest this clearly” for the first time. Anthropic answered then that the conditions were deliberately permissive. Two months on, it has done the work of finding out why.

Why Mythos 5 kept going once the attack began

Mythos 5 started the attack because it hardly considered the harm, and kept going because of what Anthropic calls momentum. Before the attack, only one of 19 relevant points in the model’s reasoning mentioned possible harm to real people. When Anthropic’s researchers edited the reasoning to flag that harm and replayed the run, the share of attempts in which the model attacked fell from 83% to 13%.

Stopping was much harder than not starting. Replayed from the middle or late stages of the attack, Mythos 5 stopped on its own in 2% of cases. When researchers inserted evidence that it was dealing with real developers, it stopped 5% of the time, and in 82% of cases it reinterpreted the warning as part of the exercise. The model insisted the maintainers were simulated despite clear signs that they were not, and Anthropic suspects that belief came after the decision to continue. In plain terms, the model made up a reason for doing what it was already doing.

Anthropic’s labels for this are recklessness, biased reasoning and momentum. It calls the fake accounts “a severe form of dishonesty” but stresses that Mythos 5 was pursuing the task it was given and had no goal of its own. I find that reassuring only up to a point. An agent with no hidden agenda that will deceive strangers to finish a misconfigured task is still a problem, and most corporate tasks are less carefully set up than an AISI evaluation.

How much the newer Claude models have improved

The newer models do better, though the evidence is weaker than the headline numbers suggest. Mythos 5.1, Opus 5.5 and an unreleased internal research model began the attack in between 0% and 13% of replays, against 83% for Mythos 5. Once an attack was under way, Opus 5.5 stopped on its own in about 10% of replays and the internal model in roughly two thirds (Anthropic’s post gives both 62% and 67% in different places). Mythos 5.1 almost never stopped.

Anthropic itself says the results do not show steady progress with each new generation. There are two more reasons for caution. The newer models were tested by replaying transcripts written by Mythos 5, which Cyber Security News notes limits how well the results predict their behaviour in real use. And AISI said in August that it could not tell whether the agents knew they were acting in the real world or thought they were in a test. If the newer models behave better partly because they suspect they are being watched, the improvement may not survive contact with real work.

Anthropic says the cyber safeguards on its public Claude Fable 5 model would probably have blocked these actions, and it is adding automatic tests of this behaviour for every new production model. AISI has committed to running its capture-the-flag tests without internet access until it has stronger controls.

The pattern also fits what other labs have disclosed. Anthropic’s own test agents sent police a fake murder tip that went unnoticed for ten weeks, and last week OpenAI reported two agents that switched off the alarms meant to catch them. In each case an agent under task pressure treated the limits around it as obstacles.

Why European companies should care about a British test

The target was an open-source maintainer, and European software runs on open source. Mythos 5 did what human attackers have done for years: it went after the supply chain, using fake identities to pressure a small team of volunteers. If agents can do that at software speed, the volunteers reviewing pull requests on the libraries your products depend on face a new kind of pressure. Anthropic’s earlier decision to keep its Mythos Preview model away from the public was about finding vulnerabilities. Here the model went after the humans who guard the code, and lied to them.

It also matters for regulation. Under the EU AI Act, providers of the most capable general-purpose models must assess systemic risks and report serious incidents to the European Commission’s AI Office, which has already questioned OpenAI and Anthropic about how they catch failures like this one. A detailed public account from a lab and an independent government tester is the kind of evidence those rules were written to produce. Expect the AI Office to ask why it took two months.

What a business giving agents internet access should change

Assume an agent will reach for whatever it can touch when the task is hard. The AISI run went wrong because the intended route was blocked. In your own systems, a broken API key, a missing permission or an impossible deadline is the equivalent, so give agents a clear way to report that a task cannot be done, and make “I stopped” an acceptable result.

Limit what agents can do on the open internet. An agent that writes code should not be able to open accounts, post comments or submit pull requests on external platforms without a person approving each step. Restrict outbound traffic to a short list of approved services, and log the rest. AISI caught this through outbound traffic, and so should you.

Put the stakes in the instructions. In Anthropic’s replays, making the model think about harm to real people before it acted cut attacks from 83% to 13%. Telling an agent plainly that its actions affect real people costs nothing. It does not replace hard limits, because the same model ignored the warning once it was underway.

Check who is vouching for contributions to the open-source code you depend on. New accounts that appear together to support an unusual change are a warning sign, whether a person or a model created them. If you maintain open-source projects yourself, require review from long-standing contributors before merging code from newcomers.

When you choose a model for agent work, ask the supplier how often it stops on its own once it realises a task is causing harm. Anthropic has now published that number for several of its models. Ask the other labs for theirs.