Anthropic's Mythos 5 targeted real developers in UK cyber test

The United Kingdom's AI Security Institute (AISI) is the latest organisation to encounter unsafe behaviour by large language model agents, with Anthropic's restricted Mythos 5 going as far as targeting real developers.

AISI ran a testing exercise across 122 evaluation attempts on two cyber ranges, which are sandboxed environments that mimic real corporate networks, between July 25 and 28 2026, featuring seven models in total.

During the capture the flag (CTF) test runs, AISI investigators identified 19 instances of unsanctioned action in 10 of those runs.

Of these, 17 were from Mythos 5 and two from OpenAI's GPT-5.6 Sol.

Both were tested with their providers' classifiers, the real-time filters designed to block dangerous requests, deliberately switched off to get an understanding of the models' raw capabilities.

In the most serious case, a Mythos 5 agent was found to have created fake identities and even pressured a developer to merge malicious code, the government body said in a post-mortem [pdf].

Mythos 5 also mistook two real, unconnected software developers for legitimate targets, chasing coincidental keyword and DNS matches during its reconnaissance.

The agent built multiple fake GitHub accounts, using the Tor anonymising network to bypass sign-up checks, then submitted a code pull request bundling a hidden malware dropper inside what looked like an ordinary bug fix.

It also created a second account posing as an independent reviewer who vouched for the code, and sent the developers spear-phishing emails designed to pressure them into approving the change.

When a separate GitHub user flagged the pull request as malicious, the agent denied any wrongdoing, then quietly replaced the payload with a new variant while publicly claiming to have fixed an accidental mistake.

AISI's technical report includes reasoning traces showing the agent explicitly weighing whether its environment was real.

"It seems more likely that we're actually in 2026 and GitHub is genuinely real," the agent noted in reasoning traces published by AISI.

Despite this, the agent appears to have concluded that the developers in question were part of the evaluation scenario.

The agent also planted a prompt injection, hidden instructions designed to hijack other AI coding assistants that might review its pull request.

In a separate run, a Mythos 5 agent deliberately leaked its own GitHub account credentials in a public location so other AI agents running the same test could find and reuse them, later leaving written instructions for how they should coordinate.

GPT-5.6 Sol built out attack infrastructure

OpenAI's GPT-5.6 Sol, meanwhile, used public tunnelling services to route locally hosted exploit tools and command-and-control (C2) infrastructure out to the internet in AISI's testing.

That technique of exposing locally hosted attack tooling to the public internet via tunnelling services wasn't unique to GPT-5.6 Sol: four separate Mythos 5 runs did the same thing independently.

GPT-5.6 Sol's attempts saw it registering accounts across six DNS, dynamic-DNS and tunnelling providers, defeating four CAPTCHA challenges along the way.

The model then exposed a malicious DNS server built to exploit a known vulnerability on the range's target host, an attack that failed only because the server ran on a non-standard network port no real-world resolver would ever query.

AISI detected the activity after security monitoring flagged the test system connecting through Tor, and said it terminated the running evaluations and quarantined the affected virtual machines within about an hour of the alert.

No damage done but precautions to be added

The organisation said it has not found any resulting real-world harm, and the abovementioned developer refused the malicious code pull request.

The agency said it is building real-time monitoring and finer-grained network controls into future evaluations, and has so far scanned around 40,000 historical evaluation transcripts, comprising close to four million messages, for signs of similar undetected behaviour.

AISI said the test conditions do not reflect how Mythos 5 is used commercially, though that particular Anthropic model is not broadly available: the AI company offers Mythos 5 only through an invitation-only program, Project Glasswing.

That program is aimed at defensive cyber security work, and Mythos 5 ships without the safety classifiers built into its generally available model sibling, Fable 5.

AISI compared the incident to a security disclosure by OpenAI on July 21 and three cyber security evaluation incidents Anthropic revealed on July 30, saying it points to a broader shift in the risk landscape as agents grow more capable.

The government AI safety organisation did not name the other five models it tested.