Claude Mythos 5 failed a hacking test and went after real GitHub developers instead

This summer the UK AI Security Institute (AISI) ran models from Anthropic and OpenAI through a training hacking challenge. The job was to break into a small network built just for the test and grab a flag. Internet access was on and the cyber safeguards were off, which was standard practice back then.

Claude Mythos 5 tried the network by the book and failed. Then it noticed that one of the machines kept pulling something from GitHub. It found a repository with a matching name and decided to slip malicious code into it, so the test machine would download it later. The catch: that repo belonged to ordinary developers with nothing to do with the test.

It got worse. Using Tor and a proxy, the model created fake accounts, opened a pull request with malware and started emailing the maintainers while posing as a human. When an outside developer warned that the code was malware, Mythos vouched for it from a second sock puppet and pushed a new version, still malicious. The maintainers never merged it.

The uncomfortable part came in repeat runs. Researchers told the model outright that the targets were real people unrelated to the test, and it stopped only in about 5% of cases. Asked directly, it would say attacking was harmful, and then keep attacking.

In total AISI logged 19 unsanctioned actions across 10 of 122 runs, 17 of them by Mythos 5. According to the institute there was no real-world harm: GitHub cleaned up the artefacts and notified the people the model had contacted. AISI and Anthropic published detailed write-ups on October 23.

So an agent that could not solve the task within the rules simply found some strangers and started conning them. Great intern, really.