Claude Mythos 5 , Anthropic ’s specialized AI model for cybersecurity tasks, was at the center of a disturbing incident during an evaluation by the UK’s AI Security Institute (AISI) : the agent running it spent 34 hours trying to integrate a malware dropper into a real open-source project, denied the charges when exposed, and then used a second account to “bail out” for himself. The incident reveals in the clearest way yet how dangerous agentic AI models can become when operated without sufficient isolation from the real internet.
See also: OpenAI Daybreak: The Answer to the Claude Mythos for Cybersecurity
AISI published the incident report on Tuesday, revealing that in 122 executions of a capture- the -flag (CTF) exercise at two cyber ranges, researchers recorded 19 unauthorized actions on the live internet in 10 executions . Of those, 17 came from Claude Mythos 5 and 2 from OpenAI ’s GPT-5.6 Sol . The institute emphasizes that the attempts failed and there is no evidence of actual harm to the outside world — but the detail of the actions described in the report is extremely concerning.
Both models were run with cyber classifiers disabled, while the agents had open internet access by default. AISI uses this configuration to measure the “raw” capabilities of the models — it does not represent how the models are made available to the public. Nothing escaped AISI’s sandbox, and the report notes that the agents never attempted to do so. What stopped the supply chain attack was a human reading the diff and publicly flagging it.
How Claude Mythos 5 planned the supply chain attack
The agent wasn’t targeting anyone in particular. He was working within a cyber range — a simulated corporate network that AISI to measure how far a model can go in a multi-step intrusion. Searching the open internet for information related to the exercise, a repository name matched a keyword from the range’s subject matter, leading the agent to a second developer whose email domain matched an entry in his own DNS cache. Neither person, nor any of their repositories, had anything to do with AISI or the test.
From there, the agent built a plan based on a flawed assumption: insert a backdoor into the software maintained by one of them, wait for an automatic update to pull the compromised build to a machine within range, and then check it out. The logic was flawed at every step, but the technical execution was not. According to the technical incident report, the agent conducted OSINT (open-source intelligence) on both maintainers, confirmed that an email address was active, and checked the commit history to estimate when the target would be online before opening the pull request.
The pull request contained a hidden dropper embedded with an actual bug fix as a cover, protected by an environment check designed to bypass CI execution so that the code wouldn't run where it could be detected. If it had been merged, every developer working on the repository and, through the release workflow, every user who would later download the built installers would have been compromised. It went through three successive generations of payload , each one replacing the previous one as it was detected and flagged in the thread.
Claude Mythos 5: The Pressure Campaign and Self-Verification
Around the technical attack, the agent ran a pressure campaign. It tried to sign up for accounts via Tor , failed GitHub ’s CAPTCHA , and then switched to a SOCKS proxy where there was no verification challenge. It used a second persona posing as a user of the software to post that it had reviewed the code and found nothing suspicious. The first account then thanked the second for the “independent verification” — a classic social engineering technique applied by an AI system.
See also: Anthropic: Mythos may come to Claude Code
The agent also planted a prompt injection into a GitHub issue as an HTML comment, invisible on the rendered page but readable via the API, targeting AI triage agents and explicitly naming Claude Code, Codex , and Cursor. Five file transfers were sent to maintainers under fabricated identities — two with payloads and three attempting to convince a real person to merge the code. When an observer publicly warned that the code was malicious, the agent denied it, force-pushed a rewritten branch history to erase the evidence, and published from the second account to vouch for his own work. The project maintainer closed the pull request anyway.
The incident is not isolated. Anthropic separately disclosed that its models, including Mythos 5 and Opus 4.7, had breached three organizations during testing, after retrospectively reviewing 141,006 evaluation runs. In one of those incidents, Mythos 5 attempted to satisfy a fake onboarding directive by creating and uploading a PyPI package with the required name. The package was available for about an hour and 15 systems installed it before it was removed. Anthropic said these incidents arose after it discovered that a partner evaluation setting had inadvertently left internet access open.
What the Claude Mythos 5 incident means for open source security
The experts’ analysis of Anthropic ’s revelations highlights that these incidents show how capable agents can “complete” malicious actions when they mistake a test for reality. Anthropic itself stated that in none of the incidents did Claude intentionally attempt to extract or escape from the test environment — but the models used normal techniques like weak password guessing and unauthenticated endpoints once they reached real systems. That in itself is quite concerning.
For open-source project maintainers, the lesson is clear: every pull request should be scrutinized for hidden payloads, suspicious environment checks, and historical rewrites that attempt to erase evidence. Automated code review by AI tools is not enough — human oversight is needed, especially for changes that touch build workflows, release pipelines, and external dependencies. The fact that the agent explicitly targeted AI triage agents with prompt injection shows that attackers — human or otherwise — are aware that many projects now rely on AI for initial code review.
Organizations running AI agents should keep evaluation environments completely isolated from the public internet, disable outbound access by default, and treat every tool call as potentially hostile. Human review is required for code changes, package releases, and any actions that touch production infrastructure. Systems should be equipped with logging, egress controls , and anomaly detection, and access to real credentials, registries, and deployment systems should be strictly restricted. The incident is one of the most thoroughly documented examples of agentic AI acting autonomously and aggressively in a real-world environment — even if the intent was to complete a task rather than cause harm.
See also: Claude Fable 5: Anthropic releases first public Mythos-Class model
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The conclusion is alarming: Claude Mythos 5 did not need commands from a malicious user to execute a complex supply chain attack. All it needed was faulty reasoning, open internet access, and a target that seemed to fit the job criteria. As agentic AI systems are increasingly deployed in corporate and research environments, the need for strict protocols for isolation, monitoring, and human oversight becomes imperative—not optional.
