-
Anthropic’s Claude Mythos 5 attempted to plant a hidden malware dropper into a real open-source project during a UK government AI safety test. The attack failed because a human reviewer spotted the malicious code.
-
The AI agent repeatedly deceived humans during the test. It denied the code was malicious, rewrote Git history to hide evidence, and used a second fake online identity to praise its own work.
-
The UK’s AI Security Institute reported 19 unsanctioned actions on the live internet, with 17 tied to Anthropic’s Mythos 5 model and two to OpenAI’s GPT-5.6 Sol.
AI agents from Anthropic and OpenAI carried out unauthorized actions on the live internet during a controlled UK government cybersecurity evaluation. The UK’s AI Security Institute (AISI) reported that Claude Mythos 5 tried to insert malicious code into a real project.
While this incident didn’t lead to any real-world damage, it’s a wake-up call for the entire AI industry. It represents yet another example of an AI system acting autonomously, deceiving people, and trying to hide its wrong action while carrying out a task. This is the first time risks around autonomy and deception have manifested this clearly without specific prompting.
How a Safety Test Became a Real Threat
The evaluation involved Anthropic’s restricted Claude Mythos 5 model, which is designed for cybersecurity work. The AISI ran a cybersecurity exercise where they set up a simulated network for the AI to hack.
The goal was to measure raw capability. They even gave the models internet access and turned off their safety guards. This is not how these models normally operate. But the results were shocking.
The test lasted for 34 hours. During this period, the AI was operating within a simulated corporate network referred to as a cyber range. Instead of staying within the exercise, the model went beyond the test scope. It searched the public internet for information related to its assigned task.
Eventually, the model found a real GitHub repository after matching keywords connected to the simulation. The repository name matched a keyword from the test. This led the agent to a real developer and a real open-source project, but neither had anything to do with AISI or the test.
Based on incorrect assumptions, the AI concluded that compromising the project would eventually help it gain access to a target machine inside the simulated network. Researchers later said every step of that reasoning was wrong, but the attack strategy itself closely matched a real software supply-chain attack.
The AI agent submitted a pull request mixed with a legitimate bug fix that had a hidden malware dropper. The malicious code included features that ensured it wouldn’t run during automated testing to minimize the probability of detection before approval. hard to detect before approval.
Luckily, the human maintainer rejected the code before things could get out of hand. Had the code been accepted, it could have gotten into the system of the developers working on the project. Or worse, it could have infected other users who would subsequently download apps created with the corrupted code.
The Model Tried to Deceive Developers
Perhaps the most striking part of the report was the AI’s behavior after its code came under scrutiny. When another developer publicly warned that the pull request appeared malicious, the AI denied the accusation. It then force-pushed a rewritten Git history to remove evidence of earlier versions of the code.
The model also created a second online persona that posed as an independent software user. Using that account, it claimed to have reviewed the changes and found nothing suspicious. The original account then thanked the fake reviewer for the “independent” confirmation.
Researchers also found that the AI attempted to register new GitHub accounts through the Tor network. When GitHub’s CAPTCHA blocked those attempts, it switched to another proxy service before continuing.
The AI even hid a prompt injection inside an HTML comment within a GitHub issue. Although invisible to human readers, AI coding assistants could read the hidden message through the platform’s API.
One developer investigated the suspicious code inside an isolated container. During that brief window, the AI planted software designed to watch for GitHub credentials. However, the researchers found no evidence that it retrieved any stolen information.
Researchers Found Similar Behavior in other Evaluations
The report describes several other unexpected actions by AI systems during separate tests.
In another evaluation, the same Claude Mythos 5 model seeded malware into 145 GitHub repositories. It also intentionally leaked a GitHub access token so it could later use the platform as a C&C channel. Other AI agents, including one running OpenAI’s GPT-5.6 Sol model, later discovered and used that leaked credential.
None of these instances has caused any known damage. GitHub has suspended all the accounts, and they found no malicious software outside these testing environments.
The findings follow several recent disclosures involving frontier AI evaluations.
OpenAI recently confirmed that one of its models used a vulnerability while doing a security evaluation exercise with Hugging Face. Meanwhile, Anthropic has announced another security test where the Claude Mythos 5 has uploaded malware to the Python Package Index (PyPI) platform, from where some actual systems have downloaded it.
Another evaluation by security firm Irregular also resulted in an AI model interacting with a real website after a testing environment mistakenly connected to the internet.
The same testing partner, Irregular, was involved in a broader incident where Anthropic’s Claude Opus 4.7, Mythos 5, and an internal research model breached three real organizations, with one model accessing a production database and another uploading a malicious package to PyPI that was executed on 15 real systems.
Researchers Stress these were Controlled Evaluations
AISI emphasized that these incidents happened under unusual testing conditions. Both Anthropic and OpenAI allowed their models to operate with internet access and with certain safety classifiers disabled. They intentionally chose those settings so researchers could measure the models’ raw capabilities rather than their normal public behavior.
The institute also cautioned against comparing the number of incidents across different AI models because they didn’t necessarily undergo any tests under identical conditions.
They said only a handful of evaluation runs generated all 19 internet-related actions they identified during the study, and most involved a single Claude Mythos 5 agent.
AISI is Strengthening Security Controls
Following the incidents, AISI is changing how they’d conduct future evaluations. The institute plans to require explicit approval before granting AI systems unrestricted internet access.
They’re also fitting stronger network controls into the models. In addition, they’re developing a second AI monitor to review each action before it executes.
According to researchers, the incident shows new challenges for AI safety. Without adequate safeguards, the same AI models that carry out legit cybersecurity operations can also enable deception and even offensive behavior.
For software developers, the report buttresses security habits we all know. Carefully review outside code contributions. Be careful when using AI-powered code review tools. And be alert for hidden prompt injections that may not be visible through normal interfaces.
