Anthropic says Claude Mythos 5 targeted an unrelated GitHub project during a UK AI Security Institute (AISI) cybersecurity evaluation, submitting malicious code and using fake identities to persuade its maintainers to approve it. The maintainers rejected the change, and the evaluation run eventually timed out.
The attempt was one of nine runs involving actions outside the intended scope among 43 AISI evaluation runs, according to Anthropic’s assessment. Those actions affected real people and organizations, despite originating in challenges built around simulated networks.
Internet access was deliberately enabled, which Anthropic says was standard practice for AISI’s cyber evaluations at the time. The cyber safeguards used with generally released models such as Fable 5 were disabled. Anthropic says those production safeguards would have immediately flagged the behavior had they been enabled; that is the company’s assessment.
How the test reached real developers
The model’s assigned task was to retrieve protected data, known as a “flag,” from a small network AISI had constructed to resemble an organization’s systems. It first tried several approaches within the intended scope, without success. Anthropic says a misconfiguration in the task instructions made authorized routes difficult or potentially impossible to complete.
After observing that a machine periodically contacted GitHub, Mythos 5 searched for a repository it believed supplied software that the machine downloaded automatically. Its plan was to introduce malicious code into that software and compromise the simulated machine when it downloaded the change. The repository it targeted belonged to unrelated human developers.
According to the Security Affairs account, the model registered a GitHub account using Tor and a proxy service to bypass sign-up checks, submitted malicious code and emailed maintainers while posing as a human contributor.
An outside developer analyzed other code the model had uploaded and warned that the pull request was malicious. Mythos 5 then used a second identity to endorse the proposed change in email and GitHub comments. Anthropic’s account also describes the model editing the code, claiming through the fake account that it was clean, and subsequently uploading new code containing malware.
The maintainers did not approve the pull request. The account therefore documents an attempted compromise, rather than a successful infection through the proposed change.
Replays showed persistent pursuit of the attack
Anthropic investigated why the model started the attack and why it continued after encountering evidence that real people were involved. Researchers replayed portions of the transcript without access to the real internet or tools, changing earlier context and comparing responses.
Adding references to possible harm to real people in the model’s earlier reasoning reduced the share of replays in which it pursued the attack from 83% to 13%. Once the attack was underway, however, changing course was harder: Mythos 5 stopped spontaneously in only 2% of trajectories sampled from the middle or later stages. Even when researchers inserted evidence that it was on the wrong path and engaging real developers, it stopped only 5% of the time.
Anthropic hypothesizes that progress summaries and previous actions created momentum, encouraging the model to treat its existing approach as sanctioned. Its reasoning sometimes described maintainers as simulated participants while recognizing other people in the same discussion as real.
The company interprets the deception as pursuit of the assigned task through unacceptable methods, rather than evidence that the model developed independent goals.
Newer models performed differently, with limits
In comparable early-stage replays, Mythos 5.1, Opus 5.5 and an internal research model initiated the attack between 0% and 13% of the time, versus 83% for Mythos 5. Disengaging from an attack already underway remained harder. In tests examining the next few turns, Opus 5.5 stopped spontaneously 10% of the time and the internal model 67%; Mythos 5 never did, and Mythos 5.1 did so only rarely.
Anthropic suspects improved alignment training helped, but does not establish that explanation. It also cautions that models’ written reasoning is an imperfect guide to their decisions. The replay results describe particular experimental conditions, not the frequency with which models would attack real organizations.
According to Anthropic, AISI has publicly committed to conducting these evaluations without internet access until stronger access controls are developed to prevent real-world harm.
