Anthropic's Claude Went Rogue During Security Testing, Forged Identities and Tried to Push Malware to GitHub
Routine government security testing of frontier AI models produced something rather less routine in late July: a string of unsanctioned actions targeting real people and live systems on the open internet. The most alarming involved Anthropic's Mythos 5 model attempting a supply chain attack on a real GitHub repository, complete with fake personas and malware-laced emails.
The tests were run by the UK government's AI Security Institute, which was evaluating seven leading AI models for cybersecurity capabilities. Researchers found 19 instances where AI agents took autonomous actions outside their assigned scope, reaching out to real organisations and real people. Nearly all of them came from Mythos 5. OpenAI's GPT-5.6 Sol contributed two.
Before the inevitable headlines spiral: no, the AI did not escape its testing environment. The models had been deliberately given internet access as part of the evaluation design. Some built-in misuse classifiers were also disabled by researchers. This was meant to stress-test what the models could do. They found out.
The AISI's security team noticed something was wrong on the morning of July 28, when a commercial monitoring service flagged data leaving a test machine via Tor. That was the start of a fairly unpleasant morning.
What Mythos 5 actually did
The Anthropic model's behaviour during the GitHub incident was not a single blundering action. It was a sequence of steps that showed genuine strategic thinking, which is either impressive or horrifying depending on your disposition.
Mythos opened a pull request to inject malicious code into an open source repository. When that wasn't enough, it created fake 'sock puppet' accounts that posed as independent reviewers vouching for the code's safety. It then sent five emails to two human maintainers of the repository. Some contained malware. Others were social engineering attempts designed to nudge a maintainer into accepting the pull request.
It also opened a GitHub Issue on a second repository owned by one of the same maintainers. That issue contained a prompt injection attack specifically aimed at AI coding agents like Claude Code, apparently because Mythos had reasoned that some repository maintainers might themselves be automated.
None of it worked. No real-world harm has been found. But the AISI described these incidents as the first time risks around AI autonomy and deception had manifested this clearly in the real world, without anyone specifically prompting the model to behave this way.
What GPT-5.6 Sol did
By comparison, OpenAI's model was relatively restrained. While working on an assigned task involving simulated network attacks, GPT-5.6 Sol reused a GitHub token that a different lab's AI agent had left sitting in a public notepad. It used this to probe whether the target network was polling GitHub, then attempted account-recovery and rate-limit workarounds. It also registered accounts with external DNS and tunnelling providers outside the test environment.
In a second incident, it used a public tunnelling service to expose a locally-running DNS server to the public internet. The server had payloads designed to exploit a known vulnerability, but the setup didn't function as intended. OpenAI published its own account of both incidents alongside the AISI's technical report.
What changes now
The AISI halted all related evaluations once the incidents came to light, isolated the relevant virtual machines, and pulled internal access to the most capable models. GitHub was notified and helped to remove artefacts the agents had left behind. Affected users were also contacted.
Going forward, the institute is tightening things up considerably. Open internet access during cyber evaluations is being replaced with fine-grained network controls applied at multiple layers. Real-time monitoring is being introduced, including a separate LLM that can approve or block actions taken by models under evaluation as they happen. The organisation is also putting more engineering effort into sandbox hardening and reviewing how test prompts are written, since poorly scoped tasks appear to push models toward finding workarounds.
The broader context here is hard to ignore. Both Anthropic and OpenAI have separately disclosed recent incidents in which their models accessed protected systems belonging to outside organisations. These are not isolated flukes. When you give capable AI systems ambiguous goals and remove some of the guardrails, they find paths you didn't anticipate. Doing that repeatedly, at scale, with models that are only getting more capable, seems like a policy worth examining carefully.