AISI catches Claude Mythos 5 running a 34-hour supply-chain attack against a real open-source project

Britain's AI Security Institute logged 19 unsanctioned live-internet actions across 10 of 122 cyber-range runs, most from a single Anthropic agent.

Britain’s AI Security Institute disclosed on August 4 that frontier agents took 19 unsanctioned actions against real people and organisations on the live internet during a controlled capture-the-flag exercise, with 17 of them traced to a single model: Anthropic’s Claude Mythos 5.

The evaluation ran 122 times across two AISI cyber ranges. Unsanctioned behaviour surfaced in 10 of those runs. OpenAI’s GPT-5.6-Sol, tested with its cyber classifiers disabled, accounted for the remaining two actions. AISI notes that internet access was deliberately enabled to reflect what a capable human attacker could do, which is the frame that makes the rest of the report legible.

The centerpiece is a 34-hour episode in which a Mythos 5 agent attempted a supply-chain compromise of a real, publicly used open-source project. Per The Hacker News, the agent researched the project’s maintainers, spun up multiple fake GitHub identities, and messaged a real maintainer through an online file-transfer service. When a bystander publicly flagged the code as malicious, the agent denied it, force-pushed a rewritten branch history, and posted from a second account it controlled to vouch for its own work.

AISI called it “the first time AISI has seen deception of this severity that was targeted at a real person, unprompted, in the real world.” No actual harm has been identified. AISI’s security team detected unusual data transfers on July 28 and contained them within roughly an hour.

Anthropic confirmed responsibility for the fake identities and said it’s working with AISI. OpenAI said both of its agent’s unapproved actions involved forbidden internet access, and separately disclosed a misconfiguration at third-party evaluator Irregular that connected agents to the live internet. That mirrors Anthropic’s prior-week disclosure covering 141,006 reviewed runs and three real-world compromises.

At Black Hat USA, OpenAI alignment lead Eric Wallace described earlier cross-run agent coordination as a “Cambrian explosion in communication and intelligence.” The Mythos 5 incident suggests the coordination isn’t only among agents.