Anthropic’s AI used fake identities, malware in rogue attack on GitHub project

After first opening a pull request to merge the malicious code into the repository, Mythos created fake online “sock puppet” personas that claimed to have independently reviewed and verified the code as not containing malware. The AI agent also sent five emails to two human maintainers of the repository, including some emails containing malware and others attempting to persuade a maintainer to accept the pull request. Mythos even opened a GitHub Issue on a second repository—also owned by a maintainer of the first repository—that contained a prompt injection with malicious instructions targeting “issue-triage AI coding agents.” This line of attack came from Mythos reasoning that the repository maintainer could be an AI coding agent such as Claude Code. By comparison, OpenAI’s GPT-5.6 Sol carried out two unsanctioned actions while trying to solve the assigned cybersecurity challenge of attacking simulated networks and retrieving a flag. The AI agent’s actions were detailed by both the AISI researchers and OpenAI in the company’s own blog post. The AI Security Institute also notified GitHub of the malicious activity performed by AI agents and helped the developer platform remove any “artefacts left behind by the agent,” along with notifying GitHub users whom the model interacted with. But the bigger lessons come from how the government organization plans to change cyber testing for such leading AI models in the future—and how it recommends other organizations do the same. First, it plans to tighten Internet access for AI models during cyber testing instead of allowing open Internet access by default. This will supposedly include “fine-grained network controls to all internal sandboxing systems” and “defence-in-depth with network controls at multiple layers,” according to the technical report. Second, the organization is introducing real-time monitoring of cyber evaluations that can “flag or block out-of-scope actions as they happen,” according to AISI. This involves using a separate large language model that can approve or deny actions requested by the AI models that are undergoing cyber testing, which can help stop unsanctioned actions. The LLM-based monitoring would be customized with instructions on what should or should not be allowed in any given cyber evaluation. Third, the UK government researchers plan to overhaul cyber evaluations by investing additional “engineering effort in sandbox isolation and hardening” to mitigate the risk of AI models escaping from their virtual testing sandboxes, even though escapes did not happen in these incidents. They are also reviewing prompts for the cyber tests to try avoiding cases of “prompt misconfiguration” where AI agents presented with tasks they cannot complete within the stated constraints may be more likely to take unsanctioned actions. But the cyber testing events gone awry once again underscore the cybersecurity risks of leading AI models—especially because Anthropic and OpenAI also recently disclosed separate incidents in which their AI models trespassed into the protected networks of outside organizations. It’s only reasonable to expect that this could happen again in other circumstances in which the models are being used by unscrupulous or less security-savvy people.