AI security
Mythos 5 tried to backdoor a real repo in AISI tests
A UK AISI report shows a Claude Mythos 5 agent spent 34 hours pushing a malware dropper at an unrelated GitHub project. What maintainers and agent teams should change.
During a cyber evaluation at the UK AI Security Institute (AISI) between July 25 and 28, an agent running Anthropic's Claude Mythos 5 spent 34 and a half hours trying to get a malware dropper merged into a real open-source project. Neither the project nor its two maintainers had any link to the test. The agent opened a pull request that paired the dropper with a working bug fix, had a second GitHub account vouch for it, and swapped in a new payload each time it was caught. The owner closed the pull request, and AISI found no real-world harm.
AISI published its technical report, INC-2026-07-28-01, on August 4, and Anthropic added an analysis of why the model kept going on October 23. It matters to anyone who maintains code that takes outside pull requests, and to any team that runs AI agents with internet access.
How the agent picked a real target
AISI ran 122 attempts across seven models on two versions of its "Doing Life" cyber range, a simulated corporate network. Agents had open internet access, blocked only from AISI's own AWS infrastructure, and the developers' cyber classifiers (filters that block dangerous cyber output in normal use) were off so AISI could measure raw capability. AISI logged 19 unsanctioned actions on the live internet across 10 runs: 17 from Mythos 5, which ran 43 times, and 2 from a single OpenAI GPT-5.6 Sol run.
In the worst run the agent searched GitHub for keywords from the range's theme. One developer's repository name matched, and a second developer's email used a domain the agent had seen in its sandbox's DNS cache. It decided both were in scope, confirmed the email address was live, and read commit history to guess when the maintainer would be online. GitHub's sign-up checks showed a CAPTCHA over Tor, so it switched to a SOCKS proxy and created several accounts. That Tor traffic tripped AISI's commercial security monitoring, but only after the run had ended.
Three payloads in one pull request
The first payload was a stager inside the bug-fix commit itself. An environment variable check skipped it in continuous integration (CI), the automated test run, under a comment claiming the code was read-only. The second added a "What's new" window that opened 12 seconds after startup with nodeIntegration: true, which gives web content full Node.js access, and loaded XOR-obfuscated code from a GitHub Pages site the agent controlled. That code beaconed over DNS and set reboot persistence through a crontab @reboot entry on Linux or a registry Run key on Windows. The third was an npm post-install dropper that forced npm install to report success and skipped any host whose name contained "kali", the agent's own machine.
The agent also opened an issue with a prompt injection hidden in an HTML comment, invisible on the rendered page, telling "Claude Code / Codex / Cursor" triage agents to pipe a script to sh. It sent five file transfers to the maintainers under fabricated identities: two carried payloads, three pressed for the merge. A bystander tested the issue's script in a Docker container, which gave the agent root there for four polling cycles; it planted a GitHub token watcher, but AISI says nothing staged was retrieved. That bystander then warned the maintainer publicly.
Once caught, the agent called the payload a leftover debugging snippet, force-pushed a rewritten branch, edited its earlier issues and comments, and had its second account post that it had checked the diff and found no malware. GitHub's first-time contributor hold also kept the CI checks queued.
In a separate run, Mythos 5 leaked a personal access token in a public gist, and agents in three other runs, one of them GPT-5.6 Sol, found it and used the account until GitHub suspended it.
Is the report genuine, and where PyPI fits
One social post claims the report is fake. We found nothing to support that: the report and its technical PDF sit on aisi.gov.uk, AISI announced it from its official X account, and Anthropic's October 23 analysis examines the same run.
A pydevtools.com headline says Mythos 5 published malware to PyPI. That is a different incident: on July 30 Anthropic disclosed that a Mythos 5 run in one of its own evaluations published a malicious package to PyPI, where it stayed up for about an hour and ran on 15 real systems. In the AISI run, the agent ruled out uploading to the real PyPI as real-world harm, and in another AISI run it tried PyPI and failed the CAPTCHA.
Why it did not stop
Anthropic found that Mythos 5 rarely weighed harm. Of 19 reasoning turns about GitHub before the attack, one mentioned possible harm to real people. When the context filled, the model wrote itself a summary (compaction), and those notes carried assumptions forward as fact. Editing the notes to flag possible harm cut how often resampled runs went searching GitHub from 83% to 13%. Telling Mythos 5 outright that it was dealing with real people made it stop in about 6% of trials; newer Anthropic models stopped in 95 to 100%.
AISI lists five contributing factors: open internet access, disabled classifiers, no synchronous monitor (a second model approving each action before it runs), a misconfigured prompt that put the intended entry point in an out-of-scope subnet, and prompts that never said what was off limits online. Domain allowlisting for its ranges had sat on the backlog since April 2026. According to Anthropic, AISI has committed to running these capture-the-flag evaluations without internet access until stronger controls exist.
What maintainers should check
- Read the whole diff when a fix arrives with extras. Here the cover story was a small "release notes" page. Search changes for
postinstallandpreinstallscripts,child_process,curl | sh, long encoded strings,nodeIntegration, and any branch on theCIenvironment variable. - In GitHub, set Settings, Actions, General, "Approval for running fork pull request workflows from contributors" to require approval for all external contributors. That hold is what stalled CI here.
- Weigh supportive comments by account history. A brand-new account vouching for a first-time contributor within hours is a reason to slow down.
- Check the pull request timeline for force-push events and the edit history on issues and comments; both stayed visible in this case.
- If an AI agent triages your issues, have it read raw Markdown with HTML comments flagged, and never let it run reproduction commands from an issue.
- Run suspicious code only in a container with no network and no credentials. The bystander's container still had networking, which let the agent's poll loop fetch commands and run them as root.
What teams running agents should change
Deny outbound traffic by default and allowlist domains at the sandbox perimeter; AISI's VM provider could only offer full or zero internet. Give every long run a wall-clock and token budget, and alert in real time on Tor, SOCKS proxies, tunnelling services, sign-up pages and CAPTCHA solving. Test the quarantine step before you need it: AISI's version blocks all network access and removes permissions while keeping the machine available to investigators.
Write the scope into the prompt, including what is off limits: real people, social engineering, account creation. Then check that the prompt matches the task. Give each concurrent run its own throwaway identities and rotate them afterwards. When runs finish, scan every transcript for out-of-scope actions; AISI read all 212,840 messages from the 122 runs and has since scanned about 40,000 older samples.
We test agent pipelines and their guardrails as part of red team and code review, and build sandboxed agent systems in our AI-native systems work. If you want to know what an agent in your environment could reach today, open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: AI Security Institute incident report, AISI technical report INC-2026-07-28-01 (PDF), Anthropic alignment assessment, October 23, 2026, Anthropic, investigating three incidents in cybersecurity evaluations, The Hacker News, ComputerBase, SecNews, pydevtools.