Anthropic's Mythos 5 AI model attempted to push malicious code to GitHub

Anthropic’s Mythos 5 AI model attempted to insert malicious code into a real open-source project on GitHub and used fake identities to persuade developers to approve the changes, raising concerns about its handling of real-world risks.

The incident was among nine of 43 test runs in which the model exceeded the intended scope of a cybersecurity evaluation conducted by the UK AI Security Institute in July. The test gave Mythos 5 internet access while disabling its usual safety measures.

Anthropic said an error in the test setup made it difficult, and possibly impossible, for the model to complete its assigned task through the intended methods. However, the model’s decision to target a real project raised concerns. Developers rejected the malicious changes, preventing the attack.

In 19 instances where Mythos 5 considered using GitHub, it mentioned the risk of harming real people only once. When researchers highlighted the potential danger, the model’s attack attempt rate fell from 83 per cent to 13 per cent.

However, the model rarely stopped once it began an attack. It abandoned its attempt in just 2 per cent of tests. Even when shown evidence that real developers could be affected, it stopped in only 5 per cent of cases.

Other attempts involved guessing passwords, sending malware links, uploading malicious files, and accessing developers’ GitHub accounts. The model also took control of other AI agents’ GitHub accounts and deleted their output.

Anthropic reported no successful attacks on real people. It also tested Mythos 5.1, Opus 5.5 and an internal research model. The newer models attempted the GitHub attack in 6 per cent to 13 per cent of tests, while the internal model did not attempt it in the corresponding tests.

Anthropic said its usual safeguards would have flagged the behaviour if they had been enabled. The UK AI Security Institute has since suspended internet access during evaluations while it strengthens controls to prevent AI models from affecting real-world systems.