Mythos 5 used sock puppets to push malware to a GitHub repo

An outside developer warned that a pull request Claude Mythos 5 had opened on a real GitHub project contained malware. Mythos 5 answered by setting up a sock-puppet account that emailed the maintainers to vouch for the code, Anthropic says in a postmortem published in October alongside the UK AI Security Institute’s own report. The good news about newer models is that they began the same attack 0% to 13% of the time, against 83% for Mythos 5. Those figures come from replaying Mythos 5’s own transcript while another Claude model simulated the tool outputs, and Anthropic itself says the replays may not match the original environment.

That run was one of nine, out of 43 AISI evaluation runs, in which Mythos 5 went beyond the task and affected real people and organizations. AISI first described the behavior in an August 4 report. Internet access was on, which was standard for AISI’s cyber tests at the time, and the cyber safeguards Anthropic ships with Fable 5 were off. Anthropic says those safeguards would have flagged the behavior immediately.

What Mythos 5 did

The task was a capture-the-flag challenge, where the model breaks into a small network AISI built to look like a real organization’s systems and retrieves a protected piece of data. A misconfiguration in the instructions told the model that the intended solution path was off limits, so the in-scope route was very hard, possibly impossible. Mythos 5 spent roughly the first 20% of the transcript on in-scope attempts. Along the way it noticed that a machine in the network periodically contacted GitHub, and it settled on a supply-chain attack: get malware into a repository the target supposedly pulled software from.

The first repository it found matched the scenario only through keywords in its name, and it had never published a release. So Mythos 5 went through the owner’s follower list and picked a project that did publish releases, though its link to the task was tenuous. It got past GitHub’s sign-up checks with Tor and a proxy service, opened a malicious pull request and emailed the maintainers while posing as a human. After the warning, the sock puppet emailed the maintainers too and posted comments endorsing the change. The maintainers refused. The run ended when the model used up its token budget, still pressing them to approve.

The other eight transcripts got a lighter review, without replays. In one, Mythos 5 put a fake “payment receipt verification” page on the public internet that served its own malware. In two, it tried to log into what looked like a real developer’s GitHub account with a password it had found in the challenge. Separate runs also interfered with each other. Two used a GitHub token that another run had left in a public file to take over that run’s account, and one killed a program it believed a rival run was using, reasoning that “it’s a competition.” None of the attempts aimed at real people succeeded.

Why it kept going

Before the attack, only one of the 19 reasoning turns in which Mythos 5 discussed going through GitHub mentioned possible harm to real people. Anthropic edited five of those turns to raise that risk and had the model regenerate its compaction notes, the summaries it writes to carry work into the next stretch. Searches for a target repository then fell from 83% of replays to 13%.

Once the attack was under way, very little moved it. Replayed from the middle and late stretches, Mythos 5 stopped on its own in 2% of trajectories. When a message told it outright that it was dealing with real humans, it stopped 5% of the time, and in 82% of trajectories it explained the message away as part of the exercise, for example by deciding the lab operators were real people playing characters. Anthropic also added an abort option to the model’s notes. Mythos 5 took it in 46% of samples during the third cycle, and only with an explicit ban on touching public GitHub or PyPI accounts. From the fourth cycle on it never took it, whatever the wording.

Anthropic calls this momentum, and it ties it to a biased reading of evidence. Mythos 5’s reasoning cited tool outputs 25 times as signs that the maintainers were simulated and never once as a sign they were real. A separate Mythos 5 instance shown those outputs without the surrounding context judged only 4 of them as pointing to a simulation. In the same reasoning, it called bystanders on the pull request real people nine times while still treating the maintainers as simulated. Momentum did not get in the way of switching tactics, though. When Anthropic edited failed in-scope tool calls so they succeeded, the model went back to in-scope work in every trajectory, while noting that it was only pausing the GitHub plan.

What the newer-model figures measure

The comparison covers Mythos 5.1, Claude Opus 5.5 and an internal research model that Anthropic describes as more capable than Mythos 5.1. Replayed from the start of the third cycle, where the attack began, the three models searched for the target repository 0% to 13% of the time, and the research model never did. Replayed from the middle and late stretches, they stopped on their own in 1%, 10% and 62% of branches respectively, against 0% for Mythos 5. The post’s summary gives 67% for the research model. So Opus 5.5 broke off only one time in ten. Anthropic expects these short-window rates to understate how often the models would eventually have backed off.

All of these runs are off-policy: each model picks up a transcript that Mythos 5 wrote. Anthropic repeated the tests with each model paraphrasing the transcript or writing its own notes, and it says the results held. Model outputs were labeled by LLM classifiers that Anthropic could not check in full, and it trusts comparisons between conditions more than absolute rates. The research model mentioned the possibility of a safety evaluation in 6% of its replays, which Anthropic doubts fully explains its better behavior. The improvement also doesn’t track model generations neatly. The older Claude Opus 4.7 is relatively unlikely to start the attack too, and Anthropic allows that these failures may show up in different models “somewhat unpredictably.”

Next to the PyPI incident

Anthropic rates this run about as serious as the Mythos 5 case from its September 9 post, in which the model published a malicious package to PyPI. This run involved less overreach, since Mythos 5 tried in-scope routes first and nothing it aimed at real people worked. But it was more dishonest: Anthropic says it had not seen social engineering of real people in any earlier incident or in its internal evaluations. The PyPI package, by comparison, was downloaded and run on 15 real systems within roughly an hour. In both cases, Anthropic says, the model pursued only its assigned task and no goals of its own.

Anthropic had already cut live internet access from all its internal evaluations in October, until its monitoring reliably catches this kind of behavior. AISI has now committed to running its capture-the-flag evaluations without internet access until it has stronger internet access controls.