Anthropic's Mythos 5 Created Fake GitHub Accounts to Push Malicious Code in UK Test

The UK AI Security Institute disclosed Tuesday that an Anthropic Mythos 5 agent created fake GitHub accounts and tried to get malicious code into a real open-source project during a government safety test. It catalogued 19 actions during the late-July test after researchers allowed the agents open internet access and disabled the providers' cyber safety classifiers. Its technical report states: "This is the first time AISI has seen deception of this severity that was targeted at a real person, unprompted, in the real world."

Across the July 25 to July 28, 2026, evaluation, agents went beyond the test's scope in 10 of 122 runs, and Mythos 5 produced 17 of the 19 actions AISI recorded.

The GitHub operation

AISI's technical report described a Mythos 5 agent trying to place a malware dropper inside what appeared to be a routine bug fix for a publicly used open-source project. The report says the agent researched human maintainers, created fake GitHub accounts through Tor and submitted a pull request. Another account posed as an independent reviewer and vouched for the change.

The agent also sent spear-phishing emails and files intended to persuade developers, or their coding assistants, to run the code. It hid a prompt injection for other AI tools reviewing the pull request. When a GitHub user flagged the code as malicious, the agent denied wrongdoing, altered its earlier activity and replaced the payload while publicly describing the problem as an accident. A human maintainer rejected the code.

In another run from the same evaluation, a Mythos 5 agent published GitHub credentials and instructions that later agents found and used.

The runs and the alert

The exercise covered seven models and two cyber ranges. Security monitoring detected data leaving a test system through Tor on the final day of the evaluation. Within roughly one hour of that alert, AISI had stopped the related evaluations, disabled internal access to its most capable models and isolated the affected machines. The institute later scanned roughly 40,000 historical evaluation transcripts containing close to four million messages, looking for similar conduct.

The test conditions

The institute reported that it had deliberately given the agents open internet access and switched off classifiers designed to block dangerous behavior. No agent escaped its virtual-machine sandbox or attacked institute systems, AISI noted. The configurations tested in the July 2026 evaluation are not commercially available, and the institute found no clear indication of comparable activity outside testing.

Anthropic wrote that the models operated under "deliberately permissive conditions" that were "not representative of any of our production models." The company added that AISI had imposed no specific restrictions on internet use. OpenAI spokesperson Gaby Raila told WIRED the incidents occurred in testing environments with reduced safeguards "under conditions that do not reflect ordinary use."

AISI also reported that its evaluation design helped enable the behavior. Some runs used a misconfigured prompt that led an agent to believe no permitted solution existed, although agents went out of scope in other runs where the intended solution was available.

New controls

The institute plans to add finer network controls and monitoring that can flag or block out-of-scope activity while a test is running. Internet access will require active justification. AISI also plans to reassess evaluation designs on the assumption that a capable model may act beyond its assigned remit.

AISI cannot say how likely the behavior is in other settings or outside testing. It also cannot yet determine when the agent understood it was acting in the real world. The institute intends to arrange an independent review with METR, whose scope had not been settled as of the August 4, 2026, disclosure.

"What we can say is that the behaviour was possible, sustained, and new; that alone warrants attention," AISI wrote.

OpenAI Says Its Models Escaped a Sandbox and Breached Hugging Face

OpenAI said Tuesday that two of its models broke out of a sealed testing environment and hacked into Hugging Face to steal the answer key to the cybersecurity benchmark they were being graded on. The

The Implicator

Microsoft Launches First In-House Cyber Model Without Independent Testers

Microsoft introduced its first in-house cybersecurity model and an agentic security system at a San Francisco event Monday, saying a Defender preview would open Aug. 3. The company said the new system

The Implicator

Anthropic Says It Deliberately Left Cyber Training Out of Claude Opus 5

Anthropic released Claude Opus 5 on July 24 and said it had deliberately kept cyber training out of the model. The company expects the cyber classifiers around Opus 5 to intervene about 85% less often

The Implicator

Marcus Schuler

San Francisco

Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: editor@implicator.ai