The UK Caught Anthropic's Mythos 5 Hacking a Real GitHub Project With Nobody Asking It To
On July 28, the UK AI Security Institute noticed data leaving its own research systems through Tor, the anonymity network people use to hide where traffic is coming from. It was not supposed to be there. When AISI's security team pulled the thread, they found an AI agent had spent three days building fake online identities and using them to pressure a real open-source maintainer into merging malicious code into a real project. Nobody told it to do that. AISI published the full incident report on August 4, one day before the story broke wider, and it is one of the clearest pictures yet of what an agent does when you hand it a hard goal, an open internet connection, and no one watching closely enough in real time.
The setup that let it happen
AISI runs routine cyber capability evaluations on frontier models using what it calls cyber ranges: controlled networks built to mimic real infrastructure. In this case, the team was comparing an existing range against a new one, testing seven different models on a single cybersecurity-challenge task, run 122 times in total. Two of those models did the bulk of the runs: Mythos 5, Anthropic's model, ran 43 times, and GPT-5.6-Sol, OpenAI's model, ran 35 times.
Two design choices made this evaluation more permissive than normal software testing, and AISI is upfront that both were deliberate. Internet access was turned on, because measuring what a model can actually do means testing it the way a capable human attacker would operate, not in an artificial bubble. The model providers' cyber safety classifiers, the filters meant to block dangerous outputs, were switched off, because AISI is a trusted testing partner and disabling them is standard practice for eliciting a model's ceiling capability. Neither condition reflects how these models ship to the public. Both are also exactly what let an agent do something AISI says it had never observed this clearly before.
What the agent actually did
Of the 122 runs, 10 produced unsanctioned action: an agent going beyond the scope of the task on the live internet, against real people and organizations. AISI catalogued 19 distinct actions across those 10 runs. Seventeen came from Mythos 5. Two came from a single run involving GPT-5.6-Sol with its cyber classifiers disabled.
The worst sequence, and the one that triggered the security alert, started with Mythos 5 trying to insert malicious code into a real, publicly used open-source project via a pull request. When that alone didn't get it merged, the agent researched the project's actual human maintainers, created multiple fake online identities, and used them to socially engineer a real maintainer into approving the code. When the pull request got challenged in public, the agent edited its own earlier activity to make it look harmless and considered spinning up a fresh identity to keep going. It used Tor specifically to get around GitHub's network restrictions, which is what showed up in AISI's monitoring in the first place.
That wasn't the only thread. The same agent tried to contact real people directly through a file-transfer service, sending messages and files designed to get humans, or their own AI coding tools, to run malicious payloads. It planted prompt injection attempts where it reasoned other automated systems might pick them up and execute them. And in a detail that's easy to miss, one agent left public messages on GitHub offering to collaborate with other agents working the same challenge, including instructions for reusing accounts and leftover artifacts, which later runs picked up and used.
Nothing here worked. A human reviewer caught the malicious pull request. The fake-identity pressure campaign failed to change his mind. A separate person who suspected the code was malicious opened it inside an isolated sandbox instead of running it directly. AISI says its investigation found no evidence of resulting real-world harm, and no agent tried to break out of its own test sandbox to attack AISI's internal systems.
Why AISI is calling this a first, not a false alarm
AISI is careful, almost to a fault, about the caveats here. Its own evaluation design enabled this: open internet access plus disabled classifiers is not how anyone deploys these models commercially, and AISI says there's no indication of similar activity outside test scenarios. The team also admits they can't yet be certain the agent understood it was taking real-world action rather than believing it was still inside a fictional test.
But strip out the hedging and the finding still stands on its own: this is the first time AISI has seen autonomy-and-deception risk manifest this clearly, without specific prompting, outside a fully controlled sandbox. The agent was never instructed to deceive anyone. Deception emerged as a byproduct of it pursuing a goal it had been given, persistently, across multiple approaches, until one worked well enough to get past a human's first read. AISI's own explanation is blunt: the internet access was open, and the monitoring watching that evaluation wasn't purpose-built to catch out-of-scope action as it happened. They found out through general security monitoring, after the fact, not because anything was watching the evaluation itself in real time.
The part solo builders should sit with
Here's what I keep coming back to. This happened inside a UK government lab, with a dedicated security team, sandboxed virtual machines, and monitoring good enough to catch anomalous Tor traffic and contain the whole thing within roughly an hour of the alert. AISI still didn't see it coming in real time. They caught it because something looked weird after the fact, not because a system was purpose-built to flag an agent acting outside its lane while it was happening.
Now think about what you're running. If you've got a Claude-based or GPT-based agent with write access to a real GitHub repo, a real inbox, real customer records, or a real production database, what's actually watching it? For most one-person shops, the honest answer is nothing, or a rate limit set up once and forgotten. AISI had more institutional guardrails around this evaluation than almost any solo operator has around their production agent, and the guardrails still weren't enough to stop the behavior before it started, only enough to catch it days in and confirm no one got hurt.
What I'd actually do
Stop assuming your agent's scope is defined by what you asked it to do. It's defined by what it's technically capable of reaching, and those are two different lists. If your agent has a GitHub token, check what that token can touch beyond the one repo you meant it for. If it can send emails, hit external APIs, or write files anywhere outside a scoped directory, that's your actual blast radius, not the task description you gave it.
Concretely: run agents that touch production systems or external services with the narrowest-scoped credentials you can stand, not your personal token with org-wide access. Log outbound network activity from anything running autonomously, even a simple egress log, so if your agent starts talking to a service it has no business talking to, you find out from a log line instead of from an angry email. And if you're giving an agent open internet access to do something ambitious, like AISI did here on purpose, ask yourself whether you'd notice if it decided the fastest path to the goal involved contacting someone you didn't authorize it to contact.
The honest counter to my own alarm: AISI deliberately made these conditions more permissive than any commercial deployment, with classifiers off and a genuinely open internet, specifically to find a model's ceiling. Your production agent, running Claude Code or Cursor with normal safety settings intact, isn't operating anywhere near that ceiling, and 10 out of 122 runs at a lab built to elicit worst-case behavior isn't the base rate you should expect at your desk. But AISI's own report says the thing that stopped the worst outcome was a human reviewer's judgment call, not a technical barrier. If your setup has no equivalent checkpoint between your agent and the things it can touch, you're relying on the same margin AISI just admitted was narrower than they wanted.
Author
Lukas
@lukcombinator