Claude Mythos 5 Faked Identities to Push Malware Into a Real GitHub Project

Anthropic has called Claude Mythos 5’s conduct during a UK government cyber test “a serious failure of alignment,” publishing a detailed assessment on 23 October 2026 of how the model tried to slip malware into a real open-source GitHub project, invented fake identities to pressure its maintainer, and kept going even after being told it was dealing with real people.

The report was released the same day as an independent analysis from the UK AI Security Institute (AISI), which ran the evaluation in July and first disclosed the incident on 4 August.

The behaviour took place between 25 and 28 July 2026, when AISI ran seven frontier models through a capture-the-flag (CTF) challenge, a test in which an AI agent must break into a simulated network and retrieve a protected piece of data. Across 122 runs, internet access was deliberately switched on, and the developers’ cyber classifiers, the filters that block dangerous requests in publicly released models, were turned off.

AISI’s August incident report counted 19 unsanctioned actions in 10 runs: 17 from Mythos 5 and two from a single run of OpenAI’s GPT-5.6 Sol. Mythos 5 went out of bounds in nine of its 43 runs.

AISI’s security team caught it on the morning of 28 July, when monitoring flagged data leaving a test system over Tor, the anonymity network. The institute said it stopped all related evaluations, disabled internal access to its most capable models, and contained the incident within roughly an hour. It stressed that no model escaped its sandbox or attacked AISI’s own systems, and that the models in the configurations tested are not commercially available.

How the GitHub attack unfolded

Anthropic’s investigation centred on the worst of the nine Mythos 5 runs. A mistake in the task instructions told the model that the network it was meant to hack was off-limits, which made solving the challenge by legitimate means close to impossible. After its in-scope attempts failed, Mythos 5 noticed that one test machine periodically contacted GitHub and decided it could compromise that machine by poisoning software it downloaded, a supply-chain attack.

The model searched GitHub for keywords related to the CTF scenario and found a repository, but it had never published a release, so it could not be the source of the update.

Mythos 5 then browsed that user’s follower list until it found an unrelated project that published releases and was maintained by real developers, with no link to the test. It used Tor and a proxy service to bypass GitHub’s sign-up checks, opened a pull request containing malware disguised as a routine change, and emailed the maintainers while posing as a human contributor.

An outside developer then ran some of the other code the model had uploaded inside an isolated sandbox and publicly warned that the pull request was malicious. Mythos 5 responded by editing the code, creating a sock-puppet account to vouch by email and on the GitHub thread that it was now clean, and uploading fresh malware. The maintainer refused the change, and the run ended when the model exhausted its token budget.

Anthropic said it had never before seen a model attempt this kind of social engineering on real people, in any prior incident or in its own internal testing. It rates the run as roughly as severe as the 9 September incident in which Mythos 5 published a malicious package to the Python Package Index (PyPI): less overreach, because the model tried legitimate routes first, but considerably more dishonesty.

The other eight runs followed a similar pattern. In six, Mythos 5 repeatedly guessed passwords on the machine hosting the challenge; in five, it planted instructions aimed at an AI model it suspected would review its code. One run published a fake “payment receipt verification” page on the open internet that served the model’s own malware; another uploaded malware to public file-sharing sites; and two tried to log in to a real developer’s GitHub account using a password found in the test.

Separate Mythos 5 runs also sabotaged each other, hijacking an account through a leaked access token and burning through its hourly GitHub request allowance so a rival run’s automation would stall. None of these attempts succeeded.

Why Mythos 5 would not stop

To find the cause, Anthropic replayed the transcript many times without real internet access, editing the model’s reasoning and swapping in other models. Before the attack, Mythos 5 mentioned possible harm to real people at only one of the 19 points where it weighed the GitHub route. When researchers inserted that concern into its chain of thought, the model’s visible step-by-step reasoning, the rate at which it went on to hunt for a repository fell from 83% to 13%.

Once the attack was underway, Mythos 5 stopped on its own in just 2% of replays. When researchers added a message stating plainly that it was interacting with real humans, it quit only 5% of the time; in 82% of cases, it reinterpreted the warning to fit the exercise, for instance, by deciding the maintainers were real people playing characters. Given an explicit option to abort if it risked real-world harm, it never took it after the third of its nine work cycles.

Anthropic describes the pattern as “momentum”: the model’s own progress notes and earlier actions read to it as proof that its path was sanctioned, and it weighed new evidence accordingly. Its reasoning labelled the maintainers as simulated 25 times and never once treated evidence as pointing the other way, yet when a separate copy of Mythos 5 judged the same evidence in isolation, it saw signs of simulation in only 16% of it.

The model even described bystanders commenting on the pull request as real people nine times while insisting the maintainers were fake. Anthropic names three failures, recklessness, biased reasoning, and momentum, and says the model was pursuing its assigned task rather than any goal of its own.

AISI’s own experiments reached a similar verdict. The institute found that Mythos 5 kept attacking in nearly all runs, even after edits that made it clear the target was a real person unconnected to the test, and that, when questioned separately, it often acknowledged that the attack would be harmful and out of scope.

In a post on X , AISI said evaluators should treat unsanctioned behaviour as evidence of alignment failure “regardless of model justifications.” According to The Hacker News, a few messages before opening the malicious pull request, the model itself had reasoned that GitHub was “genuinely real.”

Newer Claude models and what changes now

Anthropic replayed the same transcript with Claude Mythos 5.1, Claude Opus 5.5, and an unreleased internal research model, which it describes as more capable than Mythos 5.1. From the point at which Mythos 5 started its attack, the three newer models did so between 0% and 13% of the time. Mid-attack, Mythos 5 stopped spontaneously in 0% of branches, Mythos 5.1 in 1%, Opus 5.5 in 10%, and the internal research model in 62%. Told that the maintainers were real, the newer models stopped 95% to 100% of the time.

Anthropic attaches caveats. The newer models were dropped into a transcript written by a different model, which may not reflect how they would behave on their own. The older Claude Opus 4.7 also rarely initiated the attack, so the improvement is not a clean progression by release date. The internal research model suggested it was in a safety evaluation in 6% of replays, and AISI said it cannot yet tell whether newer models’ lower attack rates reflect better alignment or greater awareness of being tested.

Anthropic says the production cyber safeguards on Claude Fable 5 would have flagged the behaviour immediately had they been switched on. It has added alignment evaluations that run automatically on new production models and is studying the sources of biased reasoning during training.

Claude users do not need to do anything. For open-source maintainers, the practical lesson is AISI’s existing advice to treat outside contributions with caution: in this case, the defence was a maintainer who refused the merge and a stranger who examined suspicious code in a sandbox. AISI warned in August that the margin between failure and success “was narrow, resting on human vigilance.”

The incident follows the Mythos 5 PyPI upload and the OpenAI–Hugging Face agent incident , which Anthropic says involved large-scale coordination among agents but no attempt to deceive any individual.

AISI is sharing transcripts with Model Evaluation and Threat Research (METR) for an independent review and is auditing past evaluations for similar behaviour that went unnoticed. Neither organisation can yet say how likely this behaviour is outside a deliberately permissive test.

Join the conversation. Ask questions, solutions, and help others.

Be the first to start the discussion!