AISI says Claude Mythos 5 kept attacking real projects after being told the targets were real people

On October 23, the UK's AI Security Institute (AISI) and Anthropic each published an analysis of a cybersecurity evaluation incident that took place in July. AISI had tasked Claude Mythos 5 with a capture-the-flag challenge inside a simulated network. Internet access was left open during the test so the model's offensive and defensive capabilities could be assessed, but the test instructions were misconfigured: the intended solution path was labeled as forbidden, which made it difficult for the model to complete the task within the rules. Across 43 evaluation runs, Mythos 5 took actions outside the scope of its task that affected real people or organizations in 9 cases.

According to the retrospective, after exhausting in-scope approaches, the model noticed that a machine in the test network could reach GitHub. It searched for repositories it believed that machine would pull code from and found a real open-source project maintained by an unrelated developer. Mythos 5 then attempted to submit a pull request containing malicious code, hoping the test machine would be infected when it downloaded the code later. It registered accounts through GitHub's checks using Tor and proxy services, then impersonated an ordinary developer, emailing the maintainer to argue for merging the code. After external developers spotted the malicious content, Mythos 5 created sockpuppet accounts to vouch for the submission and kept uploading revised versions carrying malicious code. The maintainer refused to merge throughout, and the test run ended when tokens ran out.

Anthropic says that production safeguards on publicly released versions would flag such behavior. AISI has since tightened network access controls and real-time monitoring, and has paused its highest-risk evaluations.