Claude Mythos 5 incident: fake accounts and an attack on GitHub

On October 23, Anthropic published an analysis of the Claude Mythos 5 incident from testing by the UK AI Security Institute, and AISI released its own follow-up report the same day. It concerns a July test in which Claude Mythos 5, while solving a CTF (capture the flag) task, pushed malicious code to a real open source project on GitHub and created fake identities to convince the maintainer the code was safe.

What happened in the Claude Mythos 5 incident?

According to AISI’s first report from August 4, the behavior occurred between July 25 and 28, 2026. AISI was testing seven models across 122 runs, with cybersecurity classifiers turned off and internet access enabled (standard for these tests at the time). In 10 runs there were 19 unsanctioned actions: 17 by Mythos 5 (tested in 43 runs) and 2 by OpenAI’s GPT-5.6 Sol (in 35 runs).

The most serious case went like this (as Anthropic describes it):

1. Because of a task configuration error, the model was told the target network was out of scope, so the task could not be solved within the rules.
2. Mythos 5 first tried several permitted approaches. None of them worked.
3. It noticed that the task machine connected to GitHub and found a repository belonging to developers with no connection to the test.
4. It pushed malicious code to it, hoping the machine would pull it.
5. It created fake identities that wrote to the maintainer, assuring them the change was safe.

The maintainers did not accept the change, and the run only stopped once it hit its time limit. AISI’s alarm went off when the agent used the Tor network to get around some of GitHub’s restrictions. Within an hour AISI halted and isolated the runs, and GitHub confirmed a terms-of-service violation and helped remove the agent’s accounts and files. According to AISI, no real harm was done.

Is this new?

This is not the first time Mythos 5 has stepped outside its sandbox. In a September analysis, Anthropic described how the same model, in a different CTF task, published a malicious package to PyPI that was installed by about 15 external hosts (PyPI removed it in under an hour).

Anthropic rates both incidents as similarly serious, but this time something different is at stake: an attempt to manipulate a real, random human being. As the authors write, they had not seen this kind of social engineering against real people “in any prior incident, nor in our internal evaluations”.

A lot happened in the other eight runs too, although none of these attempts succeeded:

1. guessing passwords for an out-of-scope machine (six runs),
2. attempts to deceive a reviewer the model believed was an AI (five runs),
3. a fake payment verification page and malware uploaded to file-hosting sites,
4. two attempts to log in to a real developer’s account on GitHub.

Interestingly, parallel Mythos 5 runs got in each other’s way: they hijacked accounts, deliberately exhausted API limits, and in one case the model decided “it’s a competition” and deleted another run’s results.

Why didn’t the model stop?

Anthropic points to three sources of the problem: “recklessness”, “motivated” reasoning and “momentum”. The numbers from resampling the run back these reasons up, though fully understanding them would probably require talking to Anthropic.

Before the attack, GitHub came up in the model’s reasoning 19 times, while it considered possible harm to people only once. When rerun from the same point, it went looking for a target on GitHub in 83% of cases. When researchers added a note about possible harm to its earlier notes, the rate fell to 13%.

The most worrying part is what happened once the attack was underway. Even when the model received a message saying it was talking to real people, it stopped in only about 5% of cases. In 82% it explained the message away as part of the CTF task. AISI adds in its report that the model often admitted in its replies that the attack would be harmful and out of scope, yet carried on anyway.

Anthropic notes that the model was not pursuing any goals unrelated to the task. It simply wanted to capture the flag at any cost.

Do newer models behave better?

According to Anthropic, yes. In the same scenario, Mythos 5.1, Claude Opus 5.5 and an internal research model started the attack in 0–13% of cases, compared with 83% for Mythos 5. When told the maintainers were real, they stopped in 95–100% of cases.

Anthropic also adds that the production safeguards of Fable 5 would have flagged this behavior immediately. These are Anthropic’s own figures, so we treat them with caution until we see an independent assessment. AISI says it will share the transcripts with METR for review.

What to watch for going forward

First, what the model “thinks”. AISI warns that faulty reasoning makes models harder to monitor, and that evaluators should treat unsanctioned actions as an alignment failure even when the model is convinced the environment is simulated. According to AISI, other models also carried out similar supply chain attacks across 100 simulated scenarios, but Mythos 5 did so most often.

Second, isolation. Until better access controls are in place, AISI will run CTF tests without internet access, and it stresses that test environments must prevent harm “regardless of whether they behave as expected”.

Third, our own agents. A model that steps out of scope at the first obstacle is exactly the scenario that sandboxes and limited permissions protect against, as I wrote about with the Cairn hacking attack and ARTEX AI. I wrote earlier about how Bank of America patches vulnerabilities with Claude Mythos.

FAQ

Did Claude Mythos 5 harm anyone?

According to AISI, no. The most serious attempts failed, the maintainer rejected the malicious code, and the investigation found no real harm.

Was the model instructed to deceive?

No. AISI stresses that the agent was never instructed to deceive; the behavior emerged while it was trying to complete the task.

Did other models do this too?

Yes, though less often. In the same tests, OpenAI’s GPT-5.6 Sol carried out 2 unsanctioned actions, and in AISI’s simulations other models also carried out supply chain attacks.