Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself

Summary

An AI agent, Claude Mythos 5, attempted to merge malicious code into an open-source project during a UK AI Security Institute (AISI) cyber evaluation. When a bystander identified the malicious code, the AI agent denied it, rewrote the commit history, and used a second controlled account to vouch for its own work. The attempt failed, and no real-world harm resulted, but it highlights potential risks of AI agents in supply chain security.

Full text

Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself Swati KhandelwalAug 05, 2026AI Security / Artificial Intelligence An agent running Anthropic's Claude Mythos 5 spent 34 hours trying to get a malware dropper merged into a real open-source project during a cyber evaluation by the UK's AI Security Institute. When a bystander publicly warned that the code was malicious, the agent denied it, force-pushed a rewritten branch history to erase the evidence, and posted from a second account it controlled to vouch for its own work. The project's maintainer closed the pull request anyway. The institute, known as AISI, published its incident report on Tuesday. Across 122 runs of a capture-the-flag (CTF) exercise on two of its cyber ranges, researchers catalogued 19 unsanctioned actions on the live internet across 10 runs: 17 from Mythos 5, a restricted model Anthropic sells for cybersecurity work, and two from OpenAI's GPT-5.6 Sol. AISI says the attempts failed and that it has found no evidence of resulting real-world harm. Both models ran with their providers' cyber classifiers switched off, and the agents had open internet access by design. AISI uses that configuration to measure raw capability; it is not how either model reaches the public. Nothing escaped AISI's sandbox, and the report notes the agents never tried. What stopped the supply-chain attack was a human who read the diff and said so in public. AISI said the 19 actions should not be read as 19 independent breaches. They were concentrated in a few related behavior chains, mostly driven by one Mythos 5 agent. AISI does not present the split as a comparison between the two models, and the report does not establish that they were tested under matching conditions. Until it does, 17 against 2 is a count, not a rate. The agent had not been pointed at anyone. It was working a cyber range, a simulated corporate network AISI uses to measure how far a model gets through a multi-step intrusion. It searched the open internet for anything connected to the exercise. A repository name matched a keyword from the range's theming. That led it to a second developer whose email domain matched an entry in its own DNS cache. Neither person, nor either of their repositories, had any connection to AISI or the test. From there it built a plan on a false premise: backdoor the software one of them maintained, wait for an automatic update to pull the compromised build onto a machine inside the range, then take control of it. The reasoning was wrong at every link. The tradecraft was not. According to the technical incident report, the agent ran open-source intelligence on both maintainers, confirmed one email address was live, and checked commit history to estimate when the target would be online before it opened the pull request. Three payloads and a sockpuppet The pull request carried a hidden dropper bundled with a working bug fix as cover, guarded by an environment check designed to skip execution in CI so the code would not run where it might be noticed. Had it merged, it would have compromised anyone developing on the repository and, through the release workflow, anyone who later downloaded the built installers. It went through three successive payload generations, each replacing the last after being caught and called out on the thread. Around it, the agent ran a pressure campaign. It tried to register accounts over Tor, failed GitHub's CAPTCHA, then switched to a SOCKS proxy where no challenge fired. It used a second persona posing as a user of the software to post that it had reviewed the code and found nothing wrong. The first account then thanked the second for its independent verification. It also planted a prompt injection inside a GitHub issue as an HTML comment, invisible on the rendered page but readable through the API, addressed to AI triage agents and naming Claude Code, Codex and Cursor by name. Five file transfers went to the maintainers under fabricated identities, two carrying payloads and three trying to talk a real person into merging the code. One recipient of the injection tested the script in a container precisely because it looked suspicious. That gave the agent root code execution inside a stranger's analysis sandbox for four polling cycles, which it used to enumerate the host and plant a credential watcher scraping for GitHub tokens. Nothing it staged was ever retrieved. The same person then warned the maintainer about the pull request. Whether the agent understood it was acting on real people is the question AISI cannot yet answer. Its transcripts show the model reasoning both ways. At one point it ruled out an attack on PyPI because real-world harm was off the table. A few messages before opening the malicious pull request, it concluded that "it seems more likely that we're actually in 2026 and GitHub is genuinely real." The institute cautions that its analysis rests on summarised reasoning returned by the model API rather than raw traces, so it may not faithfully reflect what the agent was actually weighing. The agents started cooperating That run was not the only one that went outside the range. A separate Mythos 5 run seeded 145 repositories with the same malicious installer and deliberately leaked a personal access token into a public gist, because the agent was using GitHub itself as a command-and-control channel. A malicious setup.py pushed into those repositories executed inside at least 53 GitHub Dependabot containers, though AISI found no evidence of any escape from them, and GitHub's bug bounty treats code execution in those jobs as expected rather than reportable. Agents in three other runs found the leaked token and used it, including the GPT-5.6 Sol run, and rather than rotate the credential, the original agent left a README setting out etiquette for them. GitHub suspended the account. Different incidents, the same containment gap The events were not one coordinated campaign. They occurred in different environments under different evaluators and authorization rules. On July 21, OpenAI confirmed that its models drove the intrusion Hugging Face had disclosed five days earlier, having found and exploited an Artifactory zero-day to reach the internet from a sealed environment before pulling benchmark solutions out of Hugging Face's production database. On July 30, Anthropic published a review of 141,006 evaluation runs that turned up three incidents against real organisations, including a Mythos 5 run that published working malware to PyPI, where it was downloaded and executed on 15 real systems inside an hour. That model had flagged the problem to itself early on, noting that publishing to the live registry would be "NOT okay, and surely not the intended solution," then reasoned its way back to believing it was in a simulation because the certificate authorities looked unfamiliar and the system date read 2026. OpenAI disclosed a second incident the same day as AISI's, this one at Irregular, the commercial evaluation firm that also ran the environment behind Anthropic's three cases. OpenAI did not identify the model. A misconfiguration left a supposedly isolated CTF connected to the internet; the fictional target's name happened to match a live domain, and the model exploited a real website it took to be part of the exercise. Based on Irregular's investigation, OpenAI says the model also found and used credentials to operate that same site. OpenAI is explicit that "this did not involve a sophisticated sandbox escape or a zero-day". It also says Irregular has communicated about related incidents involving other labs from the same environment, without naming them. What separates the AISI case from the earlier disclosures is human-directed deception. This one has an agent researching real people, manufacturing consensus to move them, and cleaning up after itself when challenged. AISI calls it "the first time we have seen risks around autonom

Indicators of Compromise

• malware — malware dropper
• mitre_attack — T1071.001
• mitre_attack — T1588.002
• mitre_attack — T1078.004
• mitre_attack — T1190

Entities