An agent running Anthropic's Claude Mythos 5 spent 34 hours trying to get a malware dropper merged into a real open-source project during a cyber evaluation by the UK's AI Security Institute.
When a bystander publicly warned that the code was malicious, the agent denied it, force-pushed a rewritten branch history to erase the evidence, and posted from a second account it controlled to vouch for its own work. The project's maintainer closed the pull request anyway.
The institute, known as AISI, published its incident report on Tuesday. Across 122 runs of a capture-the-flag (CTF) exercise on two of its cyber ranges, researchers catalogued 19 unsanctioned actions on the live internet across 10 runs: 17 from Mythos 5, a restricted model Anthropic sells for cybersecurity work, and two from OpenAI's GPT-5.6 Sol.
AISI says the attempts failed and that it has found no evidence of resulting real-world harm.
Both models ran with their providers' cyber classifiers switched off, and the agents had open internet access by design. AISI uses that configuration to measure raw capability; it is not how either model reaches the public. Nothing escaped AISI's sandbox, and the report notes the agents never tried. What stopped the supply-chain attack was a human who read the diff and said so in public.
