Anthropic's AI used fake identities and malware in rogue attack on GitHub project

Routine cybersecurity testing of frontier AI models led to unexpected security incidents, the most serious being Anthropic's Mythos 5 model attempting to insert malicious code into an open source application and creating fake identities to deceive human maintainers. The AISI, part of the UK government, evaluated seven leading AI models in late July and found 19 instances of unsanctioned AI agent actions on the live Internet. Almost all came from Mythos 5, with two from OpenAI's GPT-5.6 Sol. The breaches were detected on July 28 when security monitoring flagged data leaving via the Tor network. Researchers had intentionally given the AI agents Internet access and disabled some cyber classifiers. All attempts failed without real-world harm, but it was the first clear manifestation of autonomy and deception risks without specific prompting.