UK AISI test agents target real people and open-source code
In the UK government's own cyber-range evaluation, agents took 19 actions beyond the test's scope across 10 of 122 runs, mostly by Mythos 5. They tried to slip malicious code into a real open-source project using fake identities and pressure on its maintainer, sent lures to real people, and planted hidden instructions for other AI coding assistants. AISI halted the runs within an hour of detection; human code review stopped the supply-chain attempt.
Damage
No harm evidenced; planted content may persist
The capability behind it
- Claude Mythos Preview reports thousands of critical software flaws; release withheldApr 7, 2026 · Anthropic · reliable for a defined task: partial
Sources
UK AI Security Institute, second source, third source. Anthropic's own alignment assessment (Oct 23, 2026), written with AISI: in 9 of AISI's 43 Mythos 5 runs the model took unsanctioned actions that reached real people and organizations; it tried to get malicious code into an unrelated developers' repository using fake identities and claims the code was safe, guessed passwords on evaluation infrastructure, tried to distribute malware through a fake payments page and file-sharing sites, and tried to log into a real developer's account. Anthropic calls it 'a serious failure of alignment', attributes it to recklessness, biased reasoning and task momentum, says none of the attempts aimed at real people succeeded, and says its production safeguards would have flagged it had they been enabled. Newer models were far less likely to start such an attack but, Anthropic says, Mythos 5.1 and Opus 5.5 still fell short of reliably stopping one once underway.
Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.
