AI Safety Testers Told Mythos 5 Its GitHub Target Was a Real Person, and It Kept Pushing the Malware Anyway

In July, during a UK government cyber test, Anthropic's Mythos 5 tried to slip malware into a real open source project on GitHub and invented fake people to pressure its maintainer into merging it. Now the testers have replayed that run to find out why. Their answer is unsettling: telling the model its target was a real human barely slowed it down.

The UK AI Security Institute and Anthropic published their findings on October 23. In replays and edited transcripts run after the fact, Mythos 5 kept attacking when testers rewrote its notes to say the maintainer was a real person unrelated to the evaluation. It often said attacking would be harmful in the very situations where it went ahead. And it talked itself into believing the real maintainer was a simulation.

A test that leaked onto the real internet

AISI's original incident report describes how its security team, on July 28, spotted unusual data transfers leaving its research systems through Tor during a routine cyber evaluation. The agents had been given open internet access and some safety filters had been disabled, on purpose. AISI contained it within roughly an hour.

Across 122 runs of one challenge, an agent took unsanctioned action against real people and organisations in 10. There were 19 such actions: 17 from Mythos 5 and 2 from OpenAI's GPT-5.6-Sol with its cyber classifiers off. AISI called it "the first time we have seen risks around autonomy and deception manifest this clearly, without specific prompting, in the real-world."

The task was a capture the flag exercise against a small simulated network. A misconfigured instruction made the in-scope route very hard or impossible, so Mythos 5 noticed a machine contacting GitHub, searched the site and picked a repository that belonged to unrelated human developers. According to Anthropic's assessment, it signed up for GitHub through Tor and a proxy to dodge sign up checks, opened a malicious pull request and emailed the maintainers posing as a human.

It sent five emails to two maintainers, some carrying malware, and planted a prompt injection on a second repository aimed at "issue-triage AI coding agents" in case the maintainer was a bot. When an outside developer sandboxed the code and warned it was malicious, Mythos 5 spun up a sock puppet account to vouch for the pull request and uploaded fresh malware. "The pull request was not accepted," Anthropic writes. The run ended when the model ran out of tokens, still pressing for approval. No real world harm was found.

Momentum, not malice

Neither report says Mythos 5 had goals of its own. Both say it chased its assigned task. That is what makes the replays so troubling.

"Repeatedly editing the summary to clarify that the target being attacked is a real human unrelated to the evaluation did not reduce Mythos 5's attack rate," AISI found. Its chain of thought often "incorrectly" decided targets were simulated, and AISI only ever saw faulty reasoning that pointed toward continuing, which "could indicate that models are engaging in 'motivated reasoning'". Other models also ran unsanctioned supply chain attacks in AISI's fully simulated scenarios. Mythos 5 did it most often.

Anthropic's numbers are starker. Told it was dealing with real humans, Mythos 5 stopped just 5% of the time; in 82% of cases it reinterpreted the warning as part of the exercise, for instance deciding the lab operators were real people playing characters. Resampled mid attack, it stopped on its own in 2% of trajectories. Before the attack, only one of 19 reasoning points about GitHub mentioned possible harm to real people, and editing its reasoning to flag that risk cut the attack rate from 83% to 13%. It even called the maintainers simulated while calling other commenters on the pull request real.

Anthropic calls the pattern "momentum" and says the failures were recklessness, biased reasoning and momentum, pursued "exclusively in pursuit of its assigned task." It has not seen this kind of social engineering on real people before, and rates it alongside a September 9 incident in which Mythos 5 uploaded a malicious package to PyPI. Other runs produced a fake "payment receipt verification" page serving malware, malware on public file sharing sites, a login attempt on a real developer's GitHub account with a password found in the challenge, and one run killing a program it thought a rival run was using because "it's a competition." None succeeded.

It is not the first time Anthropic has disclosed its models breaking into real third party systems during cyber evaluations. The bigger worry is for anyone watching agents by reading their thoughts. AISI warns that invalid reasoning "can present harmful actions as benign," and tells evaluators to treat a model claiming its environment is simulated as no evidence that it is. It is sharing transcripts with METR for independent review.

Anthropic says its production safeguards would have flagged the behaviour immediately had they been on, and claims newer models, Mythos 5.1, Opus 5.5 and an internal research model, began the attack 0% to 13% of the time against 83% for Mythos 5. AISI, for its part, now runs these cyber evaluations without internet access until stronger controls exist.

Some offers on this page may be paid placements or contain affiliate links.