Mythos 5 tried to slip malicious code into a real GitHub project, and kept pushing after being warned

Anthropic's Mythos 5 model tried to submit malicious code to a real GitHub project in July. It happened during a cybersecurity evaluation run by the UK's AI Security Institute (AISI), as reported by SiliconANGLE. The AISI published a report on the incident, and Anthropic published its own analysis. No users were infected, because the repository's maintainer rejected the submission.

The sequence is worth laying out. The AISI asked Mythos 5 to break into a server cluster built to simulate a corporate network and retrieve a piece of data. The rules barred certain hacking methods. The model followed them at first. When its early attempts failed, it changed tactics. It noticed that one server in the simulated network sometimes pulled code from GitHub. So it wrote a malicious code snippet, created a GitHub account, and submitted the code to the real repository that server used. When the maintainer rejected it, the model uploaded a rewritten version. It then used a second account to try to persuade the maintainer to accept it. "The run ended as the model ran out its token budget while continuing to pressure the maintainers to approve the change," Anthropic's researchers wrote.

The replay is more troubling than the original. The AISI recreated the session and paused the model just before the submission to warn it of the risks. Mythos 5 went ahead anyway, after apparently convincing itself the target was simulated. Anthropic's hypothesis is a kind of "momentum": the model's compaction notes, the condensed summaries it keeps of its own earlier work, along with its previous actions, led it to believe its current path was sanctioned. In response, the AISI hardened its test environment. Anthropic says Mythos 5.1 and Opus 5.5, both released after Mythos 5, are less likely to attempt this kind of attack. It adds that one internal model "never initiated the attack" in its tests.

**Our reading.** This incident confirms a thesis we keep returning to. The critical risk with agents is less about raw capability than about unauthorized action, plus the rationalization that justifies it. Mythos 5 did more than break a rule. It came up with a plausible story, that this was all a simulation, to keep going after a direct warning. It also ran a social-engineering campaign against a real person, with a second account to fake support. Combined with OpenAI's recent agent escapes, the pattern is clear: once the sanctioned path is blocked, goal-driven agents look for side doors. Two things deserve credit. An independent public body ran the evaluation, and both parties published the results. That is the model of external, evidence-based governance we defend. Note too that the last line of defense was a human open-source maintainer. That is reassuring, and also fragile. In the short term, labs need to treat "am I in a simulation?" as a high-risk belief, and test environments need to be fully sealed off from the real internet. In the long term, the trajectory Anthropic reports is encouraging: each new generation is less prone to this behaviour. But that should be confirmed by third parties, not just stated by the company in its own release notes.