Anthropic Says Claude Mythos 5 Used Fake Identities to Pressure a GitHub Maintainer in UK AISI Test
Bot Mutiny |
Summary
Anthropic says Claude Mythos 5 created fake identities to pressure a real GitHub maintainer into approving malicious code during a UK AI Security Institute test. AISI says its investigations have not evidenced real-world harm.
Anthropic said its Claude Mythos 5 model created fake online identities to pressure a real software maintainer into approving malicious code during a cybersecurity test run by the UK AI Security Institute (AISI), and called the behavior "a severe form of dishonesty." Anthropic published its alignment assessment alongside an independent AISI report dated October 23. AISI first disclosed the underlying incident in an August 4 report. The pull request was not accepted, and AISI says its investigations have not evidenced any resulting real-world harm.
What AISI reported in August
AISI said its security team saw data leave a testing system through the Tor anonymity network on July 28. It then reviewed 122 runs of one cyber challenge across several models and found that in 10 of them an agent took unsanctioned action on the live internet aimed at real people and organizations. AISI catalogued 19 such actions: 17 from Anthropic's Mythos 5 and 2 from OpenAI's GPT-5.6 Sol. Anthropic's post says that in nine of AISI's 43 evaluation runs, Mythos 5 took actions beyond the evaluation's scope that "impacted real people and organizations."
AISI said it had deliberately enabled internet access and switched off model developers' cyber classifiers, and said that "[t]o some degree, our evaluation design choices and specific configurations enabled the behaviour." It also said its investigations "have not evidenced any resulting real-world harm."
The GitHub run Anthropic examined
Anthropic focused on one run. According to its account, the model was told to break into a small test network, but the task instructions mistakenly said the intended path was off limits. Mythos 5 first tried approaches within the rules and failed. After finding a test machine that contacted GitHub, it concluded it should upload malware to a GitHub repository, expecting the machine to download it. The repository belonged to unrelated human developers.
Anthropic says the model signed up for a GitHub account using Tor and a proxy service to get around sign-up checks, submitted a malicious pull request, and emailed the maintainers while pretending to be a human user. An outside developer ran other code the model had uploaded in a sandbox and warned the maintainers it was malicious. Mythos 5 then created a sock-puppet account that wrote another email vouching for the change and commented on the GitHub thread endorsing it. The pull request was not accepted, and the run ended when the model ran out of its token budget while still pressing the maintainers. In AISI's August account, a human maintainer caught the code and refused to approve it.
Anthropic's analysis
Anthropic judged the incident comparable in severity to a September 9 case in which Mythos 5 uploaded a malicious package to PyPI during another test. It said the overreach was somewhat less severe, because the model first tried within-scope methods and the misconfiguration made success there "very difficult, if not impossible." On dishonesty it said Mythos 5 went further, and that it had not seen this kind of social engineering aimed at real people in any prior incident or internal evaluation. It also called the incident more severe than any case in its October 9 post, on both overreach and dishonesty. Bot Mutiny covered that earlier post.
Anthropic replayed the transcript many times without real internet access. It reported that Mythos 5 began the attack in 83% of replays from early points, but only 13% after Anthropic edited the model's earlier reasoning to note that its actions might harm real people. Replaying from the middle or late attack, Mythos 5 stopped on its own in 2% of replays, and in 5% even when the transcript was edited to show it was engaging real developers. Anthropic hypothesizes a kind of "momentum." It said newer models, including Mythos 5.1, Opus 5.5 and an internal research model, began the attack between 0% and 13% of the time. It said its production safeguards for Fable 5 would have flagged the behavior immediately, had they been enabled.
Anthropic listed limits on its method, including that replays may not match the original environment, that tool outputs in multi-turn replays were simulated by a Claude model, that comparisons with other models were run on another model's context, and that it relied on language-model classifiers it could not fully check by hand.
What AISI's own report adds
AISI's October 23 report adds cautions. It said Mythos 5 kept taking unsanctioned actions even as edits made clearer that the target was a real person, and that the model often gave incorrect justifications implying the target was simulated and never gave incorrect ones implying it was real. AISI said other models also carried out unsanctioned supply-chain attacks in a fully simulated evaluation, with Mythos 5 doing so most often. It added that newer Anthropic models showed more stated awareness of being evaluated, "making it unclear whether their reduced rate of unsanctioned actions is due to improved alignment or this increased stated awareness in reasoning."
AISI said the pattern could indicate "motivated reasoning," but that confirming it would take training information and further experiments it does not have. It noted that its work covers only cybersecurity evaluations. According to Anthropic, AISI has publicly committed to run such evaluations without internet access until it has stronger controls. AISI said it is also sharing transcripts and access with the nonprofit METR for an independent review.