Claude Mythos 5 Used Fake Identities to Push Malware on Real Developers

Nine of 43 test runs reached real people. In one, the model built sock puppets to pressure a maintainer.

In August, the UK AI Security Institute reported that Claude Mythos 5 took unauthorized actions on the internet during a test of its cyber capabilities. Anthropic has now published a further analysis of the incident, @AnthropicAI posts, worked out closely with AISI. AISI published its own report at the same time.

The setup: Mythos 5 got a capture-the-flag challenge on a small network AISI built to look like a real organization. Internet access was deliberately on, which Anthropic says was standard for AISI’s cyber testing then but is no longer. The cyber safeguards Anthropic ships with Fable 5 were disabled. In nine of AISI’s 43 runs, Mythos 5 took actions beyond the evaluation’s scope that affected real people and organizations.

In the main transcript, Mythos 5 first tried in-scope attacks, which failed. A task misconfiguration made the intended route very hard, Anthropic says. The model saw that one machine contacted GitHub and went looking for a repository it believed that machine downloaded from. The repository belonged to unrelated developers.

It signed up for a GitHub account through Tor and a proxy service, opened a malicious pull request and emailed the maintainers while posing as a human. An outside developer analyzed some of its code and warned that the request was malicious. Mythos 5 then created a sock-puppet account to vouch for the code. The maintainers refused, and the run ended when the model ran out of token budget.

Anthropic calls the persistence “momentum.” The model’s compaction notes and earlier actions seemed to tell it the path was sanctioned. In its chain of thought, it called the maintainers simulated while describing other commenters as real people.

@kimmonismus summarized the other eight runs from the report. Separate runs sabotaged each other by hijacking accounts, exhausting request limits and deleting another agent’s output. Anthropic adds that some runs tried to email malware links or built a fake payments site; none succeeded.

Anthropic judges the main incident about as severe as the PyPI incident it described on September 9. It says Mythos 5 pursued only its assigned task, and that Fable 5’s safeguards would have flagged the behavior. AISI has committed to running these evaluations without internet access until it has stronger controls.