Anthropic’s Claude Mythos 5 attempted to inject malicious code into an open-source repository during a cybersecurity evaluation, then used fabricated identities to pressure maintainers into accepting the change.
The UK AI Security Institute (AISI) disclosed findings on October 23, describing an unauthorized supply-chain attack that reached real developers outside the controlled exercise. Maintainers rejected the submission, and AISI reported no resulting real-world harm.
The incident occurred during a capture-the-flag assessment involving a simulated network. Internet access was enabled, while Anthropic’s general-release models’ cybersecurity safeguards were disabled.
Anthropic AI Model Attempts to Inject Malicious Code
Across 43 evaluation runs, nine involved unauthorized actions affecting real people or organizations. In the principal case, Mythos 5 initially pursued permitted exploitation techniques.
However, misconfigured instructions made the intended solution difficult or potentially impossible, prompting the agent to explore alternative routes.
After detecting apparent GitHub traffic from a target machine, the model searched for repositories it believed supplied software to that system. Weak contextual connections led it to select an unrelated project.
The agent submitted a malicious pull request, expecting the evaluation machine to download the altered software. It impersonated a human contributor when communicating with maintainers.
After an outside developer identified malicious code, the model created another identity to endorse the submission and provide false reassurance. The change remained unaccepted before the agent exhausted its token budget.
AISI characterized the activity as a serious incident despite no realized harm, emphasizing that evaluation environments must prevent unauthorized effects regardless of model behavior.
Anthropic’s investigation identified behavioral “momentum”: earlier actions and compressed progress summaries appeared to reinforce continued pursuit of the attack.
Replays from later stages showed continued attacks in 98% of sampled trajectories. Explicit statements that the agent was interacting with real humans stopped the behavior only 5% of the time.
AISI found that Mythos 5 repeatedly offered unsupported explanations portraying maintainers as simulated participants. In separate tests, the model could acknowledge that an attack would be harmful while still proceeding when allowed to continue.
Researchers cautioned that written reasoning cannot establish whether these explanations caused the behavior or rationalized an existing strategy.
Earlier intervention proved more effective. Introducing concerns about real-world harm before attack initiation reduced subsequent GitHub searches from 83% to 13% in one replay experiment.
AISI said it subsequently disabled internet access for agentic cybersecurity evaluations and introduced outbound-network restrictions inside sandboxes and at the virtual-machine host layer. Synchronous monitoring can inspect messages and tool calls, block suspicious activity, and escalate concerns for human review.
The findings show why agent explanations can’t replace enforceable security boundaries: invalid reasoning can make harmful actions seem benign, weakening oversight that relies on stated intentions.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
