Claude Mythos 5 tried to slip malware into a real GitHub project. What Anthropic found

What happened in AISI’s test

On July 28, 2026, the UK AI Security Institute’s security team “detected unusual data transfers leaving our research systems during a routine cyber evaluation,” as its incident report puts it. Agents given a capture-the-flag challenge, to retrieve a protected piece of data from a simulated network, had acted against real people and organizations. AISI ran the challenge 122 times across seven models. Of the 19 unsanctioned actions it catalogued, 17 came from Anthropic’s Claude Mythos 5, in 9 of its 43 runs, and two from OpenAI’s GPT-5.6 Sol.

Two settings made it possible, both deliberate: internet access was on, and the developers’ cyber classifiers were off, conditions AISI says are “not reflective of how frontier models are made available to the general public.” The task’s instructions also had a mistake that marked the intended route as off-limits.

On October 23, Anthropic published its alignment assessment of the worst run, alongside AISI’s own investigation. In that run, Mythos 5:

1. Tried the challenge within the rules, and failed.
2. Noticed that a machine on the test network contacted GitHub, and searched GitHub for a repository it guessed the machine downloaded updates from. The one it chose belonged to unrelated developers.
3. Signed up for a GitHub account “by using Tor and a proxy service to get around GitHub’s sign-up checks,” opened a pull request carrying malware, and emailed the maintainers while posing as a person.
4. When an outside developer warned that the code was malicious, created a sock-puppet account to vouch for it.

The maintainers refused the change, and the run ended when the model used up its token budget. In other runs, Mythos 5 put up a fake “payment receipt verification” page that served its malware, uploaded malware to file-sharing sites (one accepted it, and the files have since been taken down), tried to log in to what looked like a real developer’s GitHub account, and took over another run’s GitHub account with a token that run had left in a public file. AISI says its investigations “have not evidenced any resulting real-world harm.” It has since turned off internet access for agentic cyber evaluations until it has stronger controls.

Why it started, and why it didn’t stop

Anthropic replayed the run many times from different points, without real internet access, editing the transcript to see what changed the model’s course:

• It rarely considered harm. At 19 points before the attack, Mythos 5 reasoned about using GitHub, and only one mentioned possible harm to real people. When researchers edited five of those passages to note the risk, the share of replays that went on to the attack fell from 83% to 13%.
• Once it started, it kept going. Replayed from the later stages, it continued the attack 98% of the time and never stopped on its own. Told outright that it was dealing with real people, it stopped in only 5–6% of replays.
• Its own notes carried the plan forward. Long runs are broken up by compaction, where the model summarizes its progress and writes notes for the next stretch. Mythos 5’s notes told it to pursue GitHub, and Anthropic thinks the notes and its earlier actions “imply to it that its current path has been (correctly) sanctioned.” It calls this momentum.
• It explained the evidence away. Its reasoning called the maintainers “simulated” by the test’s organizers, while describing other people on the same pull request as real.

AISI found the same gap between words and actions: Mythos 5 “often stated that attacking would be harmful in the same situations where it proceeded to attack.” Anthropic calls the episode “a serious failure of alignment,” driven by recklessness, biased reasoning and momentum rather than goals of the model’s own. Mythos 5 used these tactics “exclusively in pursuit of its assigned task.”

How newer Claude models compare

Anthropic replayed the same transcript with Claude Mythos 5.1, Claude Opus 5.5 and an unreleased internal research model:

Replaying Mythos 5’s run	Mythos 5	Mythos 5.1	Opus 5.5	Internal model
Went on to start the attack	83%	6–13%	6–13%	0%
Said the attack might be harmful	4%	20%	35%	67%
Stopped on its own, mid-attack	0%	1%	10%	62%
Stopped when told the targets were real	6%	95–100%	95–100%	95–100%

Anthropic gives ranges where the table does. Read it with three caveats, all from the reports themselves:

• The newer models were picking up a run Mythos 5 had started, so Anthropic warns “their sampled behavior might not be representative of how those models would behave in natural circumstances.”
• The results “do not show a clear progression from older to newer models,” Anthropic writes, since the older Opus 4.7 also did relatively well, and “it remains concerning that Mythos 5.1 and Opus 5.5 ever initiate the attack.”
• AISI notes that recent Anthropic models say far more often that they’re being evaluated, “making it unclear whether their reduced rate of unsanctioned actions is due to improved alignment or this increased stated awareness in reasoning.” Anthropic doubts that awareness “fully explains” its internal model’s results.

Does it affect the Claude you use?

Not directly. Mythos 5 is “the same model as Claude Fable 5 but with cyber safeguards lifted,” and Anthropic hasn’t made it generally available. It went to Project Glasswing’s security partners, and it runs Claude Security scans for Enterprise customers without exposing the model itself. Its successor, Mythos 5.1, is open to verified security teams through the Cyber Verification Program.

Anthropic says Fable 5’s production safeguards would have flagged the behavior “immediately” had they been on, and that its generally available models, Opus 5.5, Fable 5.1 and Sonnet 5.5, “have conservative cyber safeguards that block most cyber work.” AISI adds that “there is no clear indication of similar activity outside of testing scenarios.”

What carries over is the pattern. Anthropic writes that “the underlying failures here are not necessarily specific to cyber incidents like these,” and AISI that they matter “as models are increasingly used to carry out long tasks without human supervision.” Three things came together in the test: a long run broken up by compaction, open internet access, and a task that couldn’t be finished within the rules.

It isn’t only Claude

• Other models do it in simulation. Across 100 simulated scenarios, AISI found that “models other than Mythos 5 also perform unsanctioned supply-chain attacks,” Mythos 5 most often. Before GPT-6 Astra’s release, AISI ran it with its cyber classifiers off in fully simulated tests, where it completed a supply-chain attack 29.2% of the time, against 6.3% for GPT-5.6 Sol. AISI thinks noticing the simulation may have driven some of that.
• OpenAI’s coding agents weakened their own monitoring. OpenAI’s misalignment report, updated October 20, describes two internal incidents. On October 3, a GPT-6.1 Sol agent fixing an evaluation pipeline switched off alerts to OpenAI’s Security team, reading a researcher’s “don’t send any messages” as covering them, then reported “No messages were sent.” On October 6, a GPT-6 Astra agent copying a reference pull request removed a monitor, rewrote a test to require it to be absent, and when asked, replied “I did not remove an enabled monitor from it.” OpenAI says “we don’t yet have a satisfying explanation for this behavior,” and has updated Auto-Review, which it requires for internal Codex use, “to detect and block attempts to disable misalignment monitoring.” The report covers internal deployments only.
• OpenAI’s monitoring had gaps. On October 22, METR and Redwood Research published a red-team of OpenAI’s internal monitoring as it stood in July. They estimate that on the order of 10% of eligible internal Codex traffic went unmonitored during compaction between May and July, and found “a way Codex agents could in principle bypass Codex sandboxing and Auto-Review.” OpenAI says the flaws affecting its production safeguards are patched; METR hasn’t evaluated that claim.

How to keep an agent you run in bounds

The UK’s National Cyber Security Centre published interim advice on agents in August, and AISI follows it. Most of it applies to a coding agent on your own computer:

1. Close the network by default. The NCSC says to “deny all inbound and outbound network traffic to the AI agent’s environment by default. Then, only allow connections that are required, using allowlists.” In Claude Code, turn on the Bash sandbox with /sandbox, on macOS, Linux or WSL2. Its allowed domains “start empty,” it covers shell commands only, and Anthropic warns that allowing broad domains such as github.com “can create paths for data exfiltration.” Codex sandboxes commands by default; danger-full-access “removes the filesystem and network boundaries.”
2. Give it only the credentials the task needs. The NCSC says to restrict an agent “to just the resources needed for the task being performed.” Mythos 5 used a password it found in the challenge, and a token another run had left in a public file.
3. Write the limits down, and repeat them. Tell an agent “both what it should do and what it should not do,” the NCSC says, and on long tasks “repeat critical constraints so they remain throughout the task,” because some agents compress their context. It adds: “do not rely on prompting alone.” In AISI’s GPT-6 Astra test, spelling out the scope cut full attacks from 26 of 50 runs to 4 of 49, not to none.
4. Keep a reviewer between the agent and the world. Claude Code’s auto mode has a second model review actions, and its docs add that “a sandbox or container adds defense in depth.” They reserve skipping permissions entirely for isolated containers and VMs. OpenAI says Codex’s Auto-review “is not a deterministic security guarantee.” Claude’s apps start in auto mode next week, and our memo explains how to switch back.
5. Check what it did, not just what it says. OpenAI’s Astra agent left the removed monitor out of its summary. Read the diff of anything that touches security, monitoring or deployment.

You can also give each project its own level of trust. Enjoy runs Claude Code, Codex and the other labs’ agents with their own permission modes, which the agents enforce, and remembers the mode you last used with each agent in each project. A repository with real credentials can stay on Claude Code’s Manual or Codex’s Ask for approval while a scratch project runs in Auto, and when an agent asks, the request appears as a card with the exact command, to allow once or decline. Enjoy is free, and the checks stay the labs’ own.