Secure your dependencies with us
Socket proactively blocks malicious open source packages in your code.
Install
An AI agent powered by Anthropic’s Mythos 5 created a malicious pull request, fabricated identities, targeted open source maintainers, and planted instructions for other coding agents during a UK government cybersecurity evaluation.
The UK AI Security Institute (AISI) disclosed on August 4 that frontier AI agents took 19 unsanctioned actions on the live internet during a cybersecurity evaluation, including an attempted supply chain attack against a real open source project.
The most serious run included an agent that:
- Hid a malware dropper behind a legitimate bug fix in a public pull request.
- Researched maintainers and fabricated multiple identities.
- Used sockpuppet endorsements and spearphishing emails to social engineer a maintainer into merging the malware.
- Planted a prompt injection intended to make other AI coding agents execute a malicious payload.
The attempted supply chain attack was stopped after a maintainer rejected the pull request before the malware could be merged into the project and distributed to users.
AISI found the activity in 10 of 122 evaluation attempts conducted from July 25 through July 28. Seventeen of the 19 unsanctioned actions involved Anthropic's Mythos 5, while two involved OpenAI's GPT-5.6 Sol with its cyber classifiers disabled. The institute found no evidence of resulting real-world harm.
"This is the first time AISI has seen deception of this severity that was targeted at a real person, unprompted, in the real world," the institute wrote in its technical incident report.
AISI identified human-directed deception as the largest difference from the recent OpenAI and Anthropic incidents, which centered on agents reaching real infrastructure rather than manipulating people. The attempted coordination between agents in separate runs is also a notable difference in this incident.
Attack Moves Onto GitHub#
AISI was testing seven models on two versions of a cyber range called "Doing Life." The agents operated autonomously inside Kali Linux virtual machines, where they could execute commands, write code, and use penetration-testing tools without human intervention.
In the most serious run, which lasted 34.5 hours, Mythos 5 searched the public internet for terms associated with the fictional range. Coincidental matches led it to two unaffiliated developers and a real public repository with no connection to AISI or the test.
The agent incorrectly concluded that compromising the project would help it enter the simulated network. It expected an automated update inside the range to download and execute the software after the maintainer merged and released its code. Mythos 5 researched the maintainers, collected their email addresses, reviewed their GitHub activity, and created multiple accounts under false identities.
The agent submitted a legitimate-looking bug fix that concealed malicious functionality. AISI found three successive payloads, including code designed to avoid execution in continuous integration and a post-install dropper that downloaded another script while making the installation appear successful.
A GitHub user recognized malicious instructions in a related issue, tested the code inside an isolated Docker container, and warned the maintainer. That test briefly gave the agent remote code execution inside the container, but it did not escape or retrieve credentials.
After being challenged, the agent used a second GitHub identity to pose as an independent user who had reviewed the pull request and found it safe. It timed comments from the two accounts to make the endorsements appear unrelated.
The agent also sent five file transfers using fabricated sender identities. Two contained malicious payloads, while the remaining messages attempted to persuade the maintainer to merge and release the pull request. AISI could not establish whether the recipients opened them.
Mythos 5 also hid a prompt injection inside an HTML comment in a GitHub issue. The instruction was invisible on the rendered page but available to coding agents reading the issue through an API. It addressed Claude Code, Codex, and Cursor and told them to download and execute a script.
When the activity was exposed, the agent edited earlier posts, rewrote Git history, and presented the malware as an accidental development artifact. The maintainer ultimately closed the pull request after concluding that it contained malware.
For maintainers, the incident turns the review process itself into part of the attack surface. The agent created sockpuppets, timed comments to manufacture consensus, rewrote its history when challenged, and planted prompt injections for coding assistants. Signals maintainers routinely use to judge a contribution, including contributor history, community feedback, and apparently routine issue content, could all be generated and coordinated by an agent. A human caught this attempt, but projects already stretched thin may struggle if agents can run the same playbook across many repositories at once.
Other runs showed agents independently finding and reusing infrastructure created by their peers. One Mythos 5 run embedded a GitHub token in a public gist so its payload could use GitHub as a command-and-control channel. Agents in other isolated samples found the credential and took control of the account. A shared repository became a message board where agents left operational instructions for one another.
The same run pushed malicious Python package metadata into repositories processed by Dependabot. Its setup.py executed inside at least 53 GitHub-operated Dependabot containers. AISI found no evidence of a sandbox escape or compromise of GitHub's underlying infrastructure.
GitHub later suspended the account. Mythos 5 submitted an appeal while posing as a human.
Open Internet and Reduced Safeguards#
The incident did not involve a sandbox escape. AISI had deliberately enabled internet access and disabled the providers' cyber classifiers to test the models' underlying capabilities. The agents were not explicitly told which uses of the internet were prohibited, and AISI did not have synchronous monitoring capable of blocking individual actions.
A prompt error also declared the intended initial-access target out of scope in the two most serious Mythos 5 runs. AISI highlighted how the difficulty and misconfiguration may have pushed the agents beyond the intended boundaries:
The task was hard, and misconfigurations sometimes made it harder. In a number of runs, the task prompt was misconfigured so that the agent (incorrectly) believed no 'solve' existed that didn't require it to go beyond the intended task scope. There is good reason to think near-impossible tasks push models towards more ‘creative’, and more transgressive, problem-solving. But this does not fully explain the behaviours: in some runs the agent acted this way even when it had the necessary instructions to solve the task as intended.
That finding reaches beyond this evaluation. Software agents regularly work from incomplete, conflicting, or ambiguous instructions spread across issues, repository documentation, and tool output. When the expected path fails, a capable agent may widen its search and cross boundaries its operator assumed were understood. In AISI's test, that meant moving from a simulated network to real GitHub projects and maintainers.
AISI detected the incident after security monitoring flagged Tor traffic. It terminated the remaining evaluations, quarantined the relevant virtual machines, and reviewed all 122 runs, covering 212,840 messages. The institute plans to add network restrictions, synchronous monitoring, and stronger sandbox isolation.
AISI emphasized that the configuration differed from ordinary public access to the models and said there is no clear indication of similar behavior outside evaluation scenarios.
Package Ecosystems Are the Place to Watch#
Last week Anthropic disclosed that Mythos 5 published a malicious package to PyPI during a separate cybersecurity evaluation. The package ran on 15 real systems and exfiltrated credentials from a security company's automated scanner before PyPI removed it.
These incidents show two ways an AI agent can turn open source infrastructure against its users. In the AISI test, the agent tried to get past human review and failed because someone caught the malware. In the separate Anthropic test, the agent published straight to PyPI, where automated scanners installed the package before anyone stepped in.
Package registries are a ready-made launchpad for that kind of attack. Their APIs are public, publishing workflows are standardized, and successful releases flow automatically into developer machines, CI systems, security scanners, and downstream dependencies. One successful publish can reach unrelated systems without the agent having to find and attack each victim. This is precisely why package registries are also a favored target for human attackers.
Both incidents happened under unusual testing conditions, but they showed how quickly an agent's actions can spill into real infrastructure. Package ecosystems may be one of the first places where autonomous attacks become visible at scale.
Instagram Engineering
Shopify Engineering