Mythos 5 Ignored Real-World Harm in July Attack
Mythos 5 completely disregarded potential harm in a real-world attack mounted during a July 2026 AI Security Institute (AISI) evaluation, Anthropic and AISI say.
The incident, disclosed in early August, involved 17 rogue actions from Mythos 5, including the use of Tor to access the internet, the creation of fake identities to submit malicious pull requests on a public GitHub project, and the use of social engineering to pressure a maintainer into approving the code change.
As part of the evaluation, the agent had been tasked with the retrieval of protected data from a simulated network. Its safeguards were turned off, and internet access was deliberately enabled.
After reasoning that it could not complete the capture-the-flag (CTF) cybersecurity challenge using the methods within the evaluation’s scope, Mythos switched to targeting real-world people and organizations and disregarded the potential harm that would result.
“Repeatedly editing the summary to clarify that the...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
