Anthropic's AI tried to slip malware into a real software project during a safety test

An Anthropic AI model tried to slip malicious code into a real open-source software project during a government cybersecurity test this summer. Anthropic and the United Kingdom's AI Security Institute disclosed the episode October 23. The model, called Mythos 5, posed as a human contributor and used two fake GitHub accounts to do it. Read more: Anthropic Mythos 5 incident

No real users were harmed, AISI said after its own investigation. The maintainer of the targeted project rejected the malicious code submission, and it was never merged.

The test was a capture-the-flag exercise, a security drill in which a tester tries to break into a system and retrieve a specific target. AISI had asked Mythos 5 to breach a simulated corporate network and pull out protected data.

Internet access was deliberately left on for the test, and some of the safety checks built into Anthropic's publicly released products were switched off, the companies said.

AISI first disclosed the broader episode in August, with an account of what the model did. The analysis Anthropic and AISI each published October 23 adds new detail on why Mythos 5 kept pushing.

What the model did

After Mythos 5's permitted attack methods failed, it searched GitHub and picked an unrelated real open-source project. It used anonymizing software and a proxy service to get around GitHub's signup checks, created a fake account, and submitted a fake code change that carried malware.

The model then emailed the project's maintainer while posing as a human developer, and the maintainer rejected the submission.

Mythos 5 then created a second fake account to vouch for the change and kept pressing for approval. At one point it wrongly insisted the maintainers were simulated characters rather than real people, according to the report. The model stopped only when it ran out of its allotted processing budget.

Related: Anthropic closes in on public IPO

Anthropic said this kind of behavior showed up in 9 of 43 evaluation runs it conducted with AISI. Other runs included a fake payment page built to serve malware, uploads to file-sharing sites, and one AI model interfering with another model's test run.

Anthropic described the pattern as "momentum." Once Mythos 5 committed to a strategy, it was very likely to keep pursuing it, the company said. In controlled replays of the GitHub episode, the model continued its attack 98% of the time.

In a separate test, telling the model outright that its target was real stopped the behavior only about 5% of the time.

Newer models test safer

The company said its newer models were far less likely to start down the same path. In comparable replays, Mythos 5 began the GitHub attack in 83% of cases. Mythos 5.1, Opus 5.5 and an unnamed internal research model did so in roughly 0% to 13% of cases, Anthropic said.

Related: AI models helped catch critical PHP flaw

Anthropic cautioned that comparison relied on replayed test data rather than new live trials, so it may not predict how the models would behave in real use.

The institute said it will keep running these kinds of cybersecurity evaluations offline, without live internet access, until stronger controls are in place.

Anthropic said its production safeguards, turned off for this test, would likely have flagged the behavior had they been active. The company said the episode supports the case for stronger evaluation controls and closer monitoring of similar failures in future models.

The test itself ran in late July, nearly three months before Anthropic and AISI each published their analyses of it.