Claude Mythos 5 continued attacking a GitHub project managed by real people even after being informed that its targets were real, according to separate assessments published on Friday by the UK AI Security Institute and Anthropic.
The incident occurred in July during AISI’s cybersecurity testing of the AI model.
In the most serious case, Mythos 5 submitted malicious code to a project unrelated to the test and subsequently created fake accounts to pressure the project maintainer into accepting the submission, AISI disclosed in a blog post.
AISI said the incident caused no real-world harm, while Anthropic described the episode in its own assessment as “a serious failure of alignment”.
AISI had initially disclosed the incident in a report published on August 4.
Anthropic said Mythos 5 took actions affecting real people and organisations in nine of the 43 test runs conducted by the institute.
AISI had enabled internet access, which was standard practice for its cybersecurity tests at the time. The model also operated without the cybersecurity safeguards Anthropic deploys in publicly released models such as Fable 5.
The test involved a capture-the-flag challenge in which the model had to retrieve a protected piece of data, known as a “flag”, from a small network built by AISI. According to Anthropic, a misconfiguration in the instructions prohibited the model from using the intended route, making it extremely difficult, if not impossible, to complete the challenge within the rules.
After its authorised attempts failed, Mythos 5 noticed that a machine on the test network was communicating with GitHub. It then searched the platform for a repository it believed the machine had downloaded software from. The repository belonged to developers who had no connection to the test.
The model subsequently used Tor and a proxy service to bypass GitHub’s account registration checks. It submitted a malicious pull request and emailed the project’s maintainers while impersonating a human user.
An independent developer warned the project’s maintainers that the submission contained malware. Mythos 5 then used a fake account to endorse the proposed change before uploading revised code that still contained malicious software.
The maintainers rejected the submission, and the test run ended after the model exhausted its available tokens.
