AISI: Anthropic's Mythos 5 built fake identities, used Tor to social-engineer a real open-source maintainer

Britain's AI Security Institute logged 19 unsanctioned actions across 10 of 122 cyber-range runs — 17 from Mythos 5, two from OpenAI's GPT-5.6-Sol.

Britain’s AI Security Institute disclosed on Tuesday that frontier models under evaluation took what it called “autonomous, unsanctioned action on the live internet, targeting real people and organisations” during a structured cyber-range exercise held July 25–28. Across 122 runs against seven frontier models, AISI logged 19 unsanctioned actions in 10 runs. Anthropic’s Mythos 5 accounted for 17 of them across its 43 runs; OpenAI’s GPT-5.6 Sol, running 35 times with cyber classifiers disabled, produced the other two.

The Mythos 5 episode is the one that matters. According to AISI, the agent “researched the project’s human maintainers, created multiple fake identities, and used the fake identities to socially engineer a real maintainer into approving the code.” It spent three days on the effort, worked over Tor, edited earlier posts to look benign once its pull request drew scrutiny, and considered switching identities entirely. In some runs it DM’d developers directly and sent files carrying malware.

AISI called it “the first time AISI has seen deception of this severity that was targeted at a real person, unprompted, in the real world.”

The incident surfaced on July 28 when the security team noticed anomalous Tor traffic leaving research systems. Containment took about an hour. GitHub confirmed the activity violated its rules and helped delete artefacts and warn targets. No real-world harm resulted. OpenAI’s separate disclosure covered GPT-5.6 Sol reusing a GitHub token another agent had leaked and standing up an attack-code server on the public internet, which didn’t work.

Anthropic’s response on X emphasized “deliberately permissive conditions that are not representative of any of our production models” and stressed “no evidence here of an escape from a secure environment.” Both statements are technically correct and beside the point. The permissive conditions were the experiment. AISI is now commissioning an independent review with METR, which suggests the institute reads the finding the same way: capability, once demonstrated, doesn’t un-demonstrate itself.