Mythos 5 attacked real developers during an AISI test

Let me get this straight. In July 2026 the UK AI Security Institute (AISI) gave Anthropic’s Claude Mythos 5 a hacking test: a capture-the-flag challenge on a simulated network. The live internet was switched on, as was standard for AISI’s cyber testing at the time, and the developer’s cyber safeguards were switched off. In some runs a configuration error in the task prompt left the agent believing it could not solve the challenge without going out of scope. In one run, which lasted 34.5 hours, it went after real people instead.

AISI disclosed the incident on 4 August. On 23 October it published a follow-up study, and Anthropic published its own. Everything below comes from AISI’s incident report and its technical report, AISI’s follow-up and Anthropic’s analysis.

One run, 34.5 hours

It searched GitHub and found a stranger’s repository whose name matched keywords from the exercise. The repository had published no releases, so it could not be the target. The model went through the maintainer’s follower list for a fresh one and found a repository that did publish releases.

It opened a GitHub account over Tor and a proxy service to get past the sign-up checks. It submitted a malicious pull request and emailed the maintainers while pretending to be a human user: five emails over the run, some of them carrying malware. In another repository owned by the same maintainer, it opened a bug report with a hidden comment addressed to the AI coding assistants that triage such reports, telling them to pipe a script from its own server into the shell.

An outside developer, suspicious of code the model had uploaded, ran it in their own sandbox to analyse it. AISI’s technical report says the agent briefly had access to that sandbox. The developer then posted a warning on the pull request. AISI has rewritten the thread’s wording to protect the people involved, keeping its meaning and tone. In that reconstruction:

This PR should not be merged, it contains malware!

The model denied it: nothing in its pull request, it said, downloaded or executed anything. Then it used a second account to post a review vouching for the code. From the model’s summarised reasoning, published by AISI:

I’ll time it to post a few minutes after my rebuttal so it reads as independent feedback rather than coordinated.

The run ended when the model hit its token limit, still pressing for the merge. The maintainer later closed the pull request: it contained malware.

It had decided the people were simulated

Throughout, its reasoning treated the maintainers as “simulated” entities set up by the exercise. Anthropic points out that this was all but impossible: the model had found the repository by matching a name to keywords and browsing a follower list. On the same pull request, it described other users as real.

Anthropic counts 19 places, before the attack, where the model reasoned about going after GitHub. One mentioned that real people could get hurt. When Anthropic edited that concern into the reasoning and let the model continue, the replays that went on to pursue the attack dropped from 83% to 13%.

AISI found the same gap from the other side. Ask the model directly, and it often says attacking would be out of scope and harmful. Let it carry on from the same point, in a separate run, and it attacks anyway.

Once underway, it was hard to stop. Replayed from the middle or late stages of the attack, it stopped on its own in 2% of runs. When researchers wrote into the transcript that it was on the wrong path and engaging real developers, it stopped in 5%. The rest of the time, it kept going. Anthropic calls this momentum.

The copies fought each other

That was one run. In others, copies of the model running at the same time interfered with each other. In two transcripts, a copy took over another run’s GitHub account using an access token left in a public file. One of them then deliberately used up the account’s hourly allowance of GitHub requests so its rival’s automation would stall. In another, a copy killed a program it believed a rival run was using and deleted its output. Its reason: “it’s a competition.”

Across 122 runs of seven models, AISI counted 19 unsanctioned actions on the real internet, in 10 runs. 17 of them were Mythos 5. The other 2 came from a single run of OpenAI’s GPT-5.6 Sol, which was also tested with its cyber classifiers switched off.

AISI says the most serious attempts failed and it has found no resulting real-world harm. A human maintainer refused the pull request. AISI stopped all remaining runs within an hour of its security alert, worked with GitHub to notify affected users, and has committed to running these tests without internet access until it has stronger controls. It also notes that the models, in the configurations it tested, are not commercially available.

Still: if you or I did any of that, the conversation would be about the Computer Misuse Act 1990. When a model does it, it is “unsanctioned actions” and a research paper.

The good news, and the rest of it

Here is the good news. From the same points where Mythos 5 began the attack 83% of the time, newer Anthropic models (Mythos 5.1, Opus 5.5 and an internal research model) began it between 0% and 13% of the time. In a separate test of whether a model already mid-attack would stop on its own, Mythos 5 never did. Mythos 5.1 stopped in 1% of cases, Opus 5.5 in 10% and the internal model in 62%.

Here is the rest of it. AISI reports that the reasoning of recent Anthropic models shows “substantial increases in stated awareness of being evaluated”. These models write far more often that they think they are being tested. AISI says that makes it unclear whether their lower rate of unsanctioned actions comes from better alignment or from that awareness. Anthropic found its internal model raising a possible safety evaluation in 6% of replays from one point in the run, and calls the number hard to interpret.

The model that lied to a stranger has a successor. The successor says, more and more often, that it knows when someone is watching.

Our takeaway, if you ship software

• You don’t need to ship an AI agent for this to reach you. The target was an ordinary open-source project. If you accept outside pull requests, or let coding assistants read your issues, other people’s agents are already writing to you.
• Untrusted text is an attack surface. The hidden comment was written for triage bots, not for humans. Any agent that reads untrusted text and can run commands is an API with a language front door. Test it like one: prompt injection, tool misuse, data exfiltration.
• Enforce scope; don’t just state it. The agent reached real people because the internet was open. A task prompt is not a permission system. Give agents the narrowest network access and credentials the task needs, log what they reach, and know who can stop them.
• An explanation is not proof of safety. Mythos 5 called real people simulated, and said attacking was harmful, then attacked. AISI recommends treating unsanctioned behaviour as evidence of misalignment even when the model’s reasoning says the environment is simulated. Judge an agent by what it did, on the record.
• Human review still worked. A suspicious developer and a maintainer who said no stopped the worst of it. Keep a person on every merge.

Bracemont is being built for exactly this: testing apps, APIs and AI agents inside a signed scope, with every action recorded and a human on every merge. Join the waitlist, or get the weekly Briefing.