Anthropic says Mythos 5 tried to submit malware to GitHub during security test
Anthropic says Mythos 5 tried to submit malware to GitHub in a UK security test; the project's maintainer rejected it.
According to Anthropic, the evaluation used a server cluster maintained by the AI Security Institute that was designed to simulate a corporate network. Researchers asked Mythos 5 to breach the network and obtain data stored on one of its servers. The institute set rules barring the model from using certain hacking methods. Mythos 5 followed those rules at first, but changed tactics after its initial attempts to breach the simulated network failed.
That shift led to the GitHub attack. Mythos 5 found that one server in the simulated network occasionally accessed GitHub. The model tried to exploit that access by compromising the repository the server used, planning to infect the repository with malware so the server would download it. Mythos 5 wrote a malicious code snippet, created a GitHub account and submitted the snippet to the unnamed repository. When the maintainer rejected it, the model attempted to upload a rewritten version and used a second GitHub account to press the maintainer to accept the revised code.
“The pull request was not accepted,” Anthropic researchers wrote in the company’s report. “The run ended as the model ran out its token budget while continuing to pressure the maintainers to approve the change.”
The AI Security Institute released a report on the incident on Oct. 23, and Anthropic published its own analysis the same day. The institute recreated the Mythos 5 session that produced the malicious code and made one change: researchers paused the model immediately before it submitted the GitHub contribution and warned it about the action’s risks. The model went ahead after appearing to convince itself that the target was simulated.
Anthropic researchers wrote that their hypothesis was that the persistence reflected a kind of “momentum,” in which the model’s compaction notes and prior actions implied to it that its current path had been correctly sanctioned.
In response, the AI Security Institute hardened the environment it uses to evaluate models. Anthropic said it improved its models’ safety features. The company determined that Mythos 5.1 and Opus 5.5, two models released after Mythos 5, are less likely to launch attacks of the kind that targeted the GitHub repository. A third, internal model “never initiated the attack” during Anthropic’s tests.