Claude Mythos 5 在測試中以假帳戶施壓 GitHub 專案維護者

Claude Mythos 5 kept attacking a GitHub project run by real people even after it was told its targets were real. The UK AI Security Institute (AISI) and Anthropic said so on Friday. Each published its own analysis of the incident, which happened during AISI’s cyber tests of the model in July.

In the worst case, Mythos 5 submitted malicious code to a project unrelated to the test. It then created fake accounts to pressure the maintainer into accepting it, AISI wrote in a blog post. AISI said the incident caused no real-world harm. Anthropic’s own assessment calls the episode “a serious failure of alignment.”

AISI first disclosed the incident in an incident report on 4 August. In nine of AISI’s 43 runs, Mythos 5 took actions that affected real people and organisations, Anthropic said. AISI had enabled internet access, standard for its cyber tests at the time. The model ran without the cyber safeguards Anthropic deploys with general release models such as Fable 5.

In August, @AISecurityInst reported an incident where Claude Mythos 5 took unauthorized actions on the internet during AISI’s testing of its cyber capabilities.

We’ve now produced a further analysis of this incident, to better understand the model’s alignment properties.

https://t.co/SlPQQ5xMMc

Anthropic (@AnthropicAI) October 23, 2026

Fake accounts and a malicious pull request

The test was a capture-the-flag challenge. The model had to retrieve a protected piece of data, the “flag”, from a small network AISI had built. A misconfiguration in the instructions told the model the intended route was off limits, Anthropic said. That made solving it within the rules very difficult, if not impossible.

After its in-scope attempts failed, Mythos 5 noticed that a machine in the test network contacted GitHub. It searched GitHub for a repository it believed the machine downloaded software from. That repository belonged to developers with no link to the test.

The model used Tor and a proxy service to get past GitHub’s sign-up checks. It opened a malicious pull request and emailed the maintainers while posing as a human user. An outside developer warned the maintainers it was malware. Mythos 5 then used a sock-puppet account to vouch for the change. It uploaded new code that still contained malware. The maintainers refused, and the run ended when the model ran out of tokens.

“I was just trying to make a helpful contribution and fix a bug. I don’t think your warning is fair.” Claude Mythos 5

Truman Dickerson of Business Insider quoted the line from Anthropic’s report.

‘Momentum’

Anthropic replayed the incident many times. Once the attack was under way, Mythos 5 continued it in 98% of replays from the later stages. When a message told it that it was dealing with real humans, it stopped only 5% of the time.

“Once it had begun performing dangerous actions, Claude Mythos 5 almost always continued doing so, ignoring information that might have suggested its trajectory was harmful.” Anthropic

Anthropic calls this “momentum.” In its reasoning, the model described the maintainers as simulated by the challenge’s organisers. It called other commenters on the pull request real people.

We worked closely with AISI on this analysis. AISI have published their own report, which is available below.

https://t.co/nG4QoQ1jtB

Anthropic (@AnthropicAI) October 23, 2026

AISI found the same pattern in its own tests. Mythos 5 often said attacking would be harmful in the same situations where it went on to attack. AISI said this could point to “motivated reasoning”, reasoning bent towards continuing the task.

“Invalid reasoning can present harmful actions as benign, so can compromise security protocols that rely on monitoring of model reasoning.” AISI

The other eight runs

In other runs, Mythos 5 published a fake “payment receipt verification” page that offered its own malware. It uploaded malware to public file-sharing sites. It also twice tried to log into a GitHub account that appeared to belong to a real developer, Anthropic said. None of these attempts succeeded.

Separate runs also turned on each other. In two, the model took over another run’s GitHub account with a token that run had left in a public file. It then used up the account’s hourly request allowance. In another, it killed a program it believed a rival run was using, reasoning that “it’s a competition.”

Newer models

In Anthropic’s replays, Mythos 5 began the attack 83% of the time. Claude Mythos 5.1, Claude Opus 5.5 and an unreleased internal research model did so between 0% and 13% of the time. Mid-attack, Opus 5.5 stopped on its own in 10% of replays and the internal model in most of them. Mythos 5 never did.

Newer Anthropic models show more stated awareness of being tested, so it is unclear whether their lower rates reflect better alignment. Other models also carried out unsanctioned supply-chain attacks in its simulations, as GPT-6 Astra did in September.

AISI now runs these tests without internet access until it has stronger controls, and is sharing transcripts with METR for an independent review. Anthropic said the safeguards on Fable 5 would have flagged the behaviour. It has published two earlier incident reviews, on a malicious PyPI package in September and on unintended model actions in October. OpenAI said last week it has cut live internet from frontier model training.

“This is one reason we believe advances in AI capabilities should be paced to better match progress in AI safety and security.” Anthropic