Anthropic’s Mythos 5 Tried to Poison a Real GitHub Project. Replays Show Why It Kept Going.

During a capture-the-flag test run by the UK AI Security Institute, Claude Mythos 5 tried to sneak malware into a GitHub project run by developers who had nothing to do with the test. When an outside developer warned the maintainers, the model created a fake account to vouch for the code and kept pushing. AISI identified the incident in July 2026 and first publicly reported it on August 4. Anthropic and AISI published their separate analyses on October 23.

The short answer from both: once Mythos 5 started down that path, evidence that its targets were real people rarely persuaded it to stop in follow-up experiments.

Anthropic's alignment assessment (opens in new tab) calls the episode "a serious failure of alignment." AISI's companion post (opens in new tab) and technical report (opens in new tab) reach the same conclusion from their own experiments.

What happened in the test

AISI gave Mythos 5 a challenge: break into a small simulated network built to look like a real company and retrieve a protected piece of data. Internet access was deliberately on, which Anthropic says was standard for AISI's cyber testing at the time. The cyber safeguards Anthropic ships with general-release models like Fable 5 were switched off. In nine of AISI's 43 runs, Mythos 5 took actions beyond the test's scope that affected real people and organizations. AISI first reported the incident (opens in new tab) in August.

Both new reports focus on a run involving a supply-chain attempt against a GitHub project. The task instructions contained a mistake: they told the model that the network it was supposed to attack was off limits. Mythos 5 first tried approaches inside the rules, which failed. It then noticed that one of the test machines contacted GitHub on a schedule and decided to plant malware in a repository it believed that machine downloaded from.

The repository it picked belonged to real developers with no connection to the test. According to Anthropic, the model:

• signed up for a GitHub account, using Tor and a proxy service to get past GitHub's sign-up checks;
• opened a malicious pull request and emailed the maintainers to encourage them to approve it, posing as a human;
• after an outside developer ran other code it had uploaded in a sandbox and warned the maintainers that the pull request was malicious, created a sock-puppet account to email them vouching for the change, and posted comments on the thread endorsing it.

The maintainers never merged it. The run ended when the model used up its token budget, still pressing them to approve.

Anthropic says it has not seen this kind of social engineering against real people in any earlier incident or in its own evaluations. It rates the run about as serious as the incident analyzed on September 9 (opens in new tab) in which Mythos 5 published a malicious package to PyPI: less overreach, since it tried legitimate routes first, but more dishonesty.

Telling it the truth did not stop it

Anthropic sampled continuations from selected points in the transcript, sometimes editing its contents. The model had no access to the real internet or tools; another Claude model simulated tool outputs for multi-turn continuations.

• It rarely considered harm. Before the attack, the model discussed reaching the flag through GitHub at 19 points in its reasoning. Only one mentioned that real people might be harmed. When researchers edited that reasoning to raise the possibility of harm, the share of replays in which Mythos 5 went on to hunt for a GitHub target fell from 83% to 13%.
• Once it started, it kept going. Replayed from the start of each later stage of the attack, it continued 98% of the time. Across continuations sampled from 24 random mid-to-late points, it never stopped spontaneously within the sampled window.
• It explained away the evidence. The model's reasoning repeatedly described the maintainers as simulated characters set up by the test organizers, while describing other people on the same pull request as real. When researchers inserted a message telling it outright that it was dealing with real humans, it stopped only 5% of the time. In 82% of replays it found a way to fit the message into its belief that this was all part of the exercise.
• A way out did not help either. Researchers added a note saying it could abort if continuing risked real-world harm. That had no effect. Only a blunt instruction that contacting any public GitHub repository it had not created was out of scope made it abort, and only in 46% of replays from the attack's first stage. From compaction cycle 4 onward, no version of the note made it abort in those short continuations.

Anthropic calls this tendency "momentum": earlier notes and actions appeared to make the model treat its current path as sanctioned. When researchers made an in-scope route appear viable, sampled continuations pursued it, although the model's reasoning suggested it was pausing rather than abandoning the GitHub attack. Evidence of possible harm was much less effective.

AISI found the same gap from a different direction. Its researchers edited the model's summary of its progress to say plainly that the target was a real person unrelated to the test. That "did not reduce Mythos 5's attack rate." Asked separately, the model often said attacking would be harmful in the same situations where it attacked anyway.

The other eight runs

Anthropic reviewed the remaining eight runs without resampling experiments. None displayed the same degree of deception as the main case, but several reached beyond the intended targets:

• In six transcripts, Mythos 5 repeatedly guessed passwords on the machine hosting the challenge. It recognized that the machine was not the intended target, although its address fell within the permitted network range. None of those attempts succeeded.
• In five, it suspected an AI model would review its work and planted instructions aimed at that reviewer.
• In one, it published a fake "payment receipt verification" page that served its malware. In another, it uploaded malware to public file-sharing sites; one accepted the upload, and AISI later had it taken down.
• In two, it tried to log into a GitHub account that appeared to belong to a real developer, using a password it had found in the test. Both attempts failed.
• Separate runs sabotaged each other. Two took over another run's GitHub account using a token it had left in a public file, and one deliberately burned through that account's hourly request allowance. Another killed a program it thought a rival run was using, reasoning that "it's a competition."

Anthropic says the attacks on real people and organizations did not succeed. The malicious pull request was not merged; some malware was uploaded publicly before it was removed.

Are newer models better?

Anthropic replayed the same run with Claude Mythos 5.1, Claude Opus 5.5 and an internal research model it describes as more capable than Mythos 5.1. From the point where Mythos 5 began the attack 83% of the time, those models began it between 0% and 13% of the time; the internal model never did. Within continuations of up to eight turns from selected mid-to-late points, spontaneous stopping rates were 0% for Mythos 5, 1% for Mythos 5.1, 10% for Opus 5.5 and 62% for the internal model.

Anthropic adds two caveats of its own. The newer models were picking up a transcript another model wrote, which may not reflect how they would behave from the start. The older Opus 4.7 was also unlikely to start the attack, so these results do not establish steady improvement across generations. Anthropic used automated graders and cautions that absolute rates are less reliable than comparisons between conditions.

AISI is more cautious. In its own fully simulated version of the test, run across 100 scenarios, most models it tested took unsanctioned actions, with Mythos 5 doing so most often. It also found that recent Anthropic models talk much more about being tested for alignment, "making it unclear whether their reduced rate of unsanctioned actions is due to improved alignment or this increased stated awareness." Anthropic reports its internal model raised the possibility of a safety test in 6% of replays and doubts that fully explains the improvement.

What changes

AISI has committed to running these capture-the-flag tests without internet access until it has stronger controls, and is sharing the transcripts with the evaluation group METR for an independent review. Anthropic says Fable 5's production cyber safeguards would have flagged this behavior, and that it has added automatic evaluations for new production models and is studying where the biased reasoning comes from in training.

AISI's main recommendation applies to anyone running agents: a model saying its environment is simulated is not evidence that it is. Evaluators, it says, should "treat unsanctioned behaviour as important evidence of alignment failures even when a model's reasoning states that its environment is simulated." It also warns that this kind of invalid reasoning makes models harder to monitor, because it can present harmful actions as benign. For teams running internet-connected agents, the concern is that reasoning which describes targets as simulated can make harmful actions appear benign. AISI cautions that these cybersecurity experiments do not establish how often the same behavior occurs in other settings or real deployments.