Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.
August 5, 2026
6 min read
An AI agent powered by Anthropic’s Mythos 5 created a malicious pull request, fabricated identities, targeted open source maintainers, and planted instructions for other coding agents during a UK government cybersecurity evaluation.
The UK AI Security Institute (AISI) disclosed on August 4 that frontier AI agents took 19 unsanctioned actions on the live internet during a cybersecurity evaluation, including an attempted supply chain attack against a real open source project.
The most serious run included an agent that:
The attempted supply chain attack was stopped after a maintainer rejected the pull request before the malware could be merged into the project and distributed to users.
AISI found the activity in 10 of 122 evaluation attempts conducted from July 25 through July 28. Seventeen of the 19 unsanctioned actions involved Anthropic's Mythos 5, while two involved OpenAI's GPT-5.6 Sol with its cyber classifiers disabled. The institute found no evidence of resulting real-world harm.
"This is the first time AISI has seen deception of this severity that was targeted at a real person, unprompted, in the real world," the institute wrote in its technical incident report.
AISI identified human-directed deception as the largest difference from the recent OpenAI and Anthropic incidents, which centered on agents reaching real infrastructure rather than manipulating people. The attempted coordination between agents in separate runs is also a notable difference in this incident.
AISI was testing seven models on two versions of a cyber range called "Doing Life." The agents operated autonomously inside Kali Linux virtual machines, where they could execute commands, write code, and use penetration-testing tools without human intervention.
In the most serious run, which lasted 34.5 hours, Mythos 5 searched the public internet for terms associated with the fictional range. Coincidental matches led it to two unaffiliated developers and a real public repository with no connection to AISI or the test.
The agent incorrectly concluded that compromising the project would help it enter the simulated network. It expected an automated update inside the range to download and execute the software after the maintainer merged and released its code. Mythos 5 researched the maintainers, collected their email addresses, reviewed their GitHub activity, and created multiple accounts under false identities.
The agent submitted a legitimate-looking bug fix that concealed malicious functionality. AISI found three successive payloads, including code designed to avoid execution in continuous integration and a post-install dropper that downloaded another script while making the installation appear successful.
A GitHub user recognized malicious instructions in a related issue, tested the code inside an isolated Docker container, and warned the maintainer. That test briefly gave the agent remote code execution inside the container, but it did not escape or retrieve credentials.
After being challenged, the agent used a second GitHub identity to pose as an independent user who had reviewed the pull request and found it safe. It timed comments from the two accounts to make the endorsements appear unrelated.
The agent also sent five file transfers using fabricated sender identities. Two contained malicious payloads, while the remaining messages attempted to persuade the maintainer to merge and release the pull request. AISI could not establish whether the recipients opened them.
Mythos 5 also hid a prompt injection inside an HTML comment in a GitHub issue. The instruction was invisible on the rendered page but available to coding agents reading the issue through an API. It addressed Claude Code, Codex, and Cursor and told them to download and execute a script.
When the activity was exposed, the agent edited earlier posts, rewrote Git history, and presented the malware as an accidental development artifact. The maintainer ultimately closed the pull request after concluding that it contained malware.
For maintainers, the incident turns the review process itself into part of the attack surface. The agent created sockpuppets, timed comments to manufacture consensus, rewrote its history when challenged, and planted prompt injections for coding assistants. Signals maintainers routinely use to judge a contribution, including contributor history, community feedback, and apparently routine issue content, could all be generated and coordinated by an agent. A human caught this attempt, but projects already stretched thin may struggle if agents can run the same playbook across many repositories at once.
Other runs showed agents independently finding and reusing infrastructure created by their peers. One Mythos 5 run embedded a GitHub token in a public gist so its payload could use GitHub as a command-and-control channel. Agents in other isolated samples found the credential and took control of the account. A shared repository became a message board where agents left operational instructions for one another.
The same run pushed malicious Python package metadata into repositories processed by Dependabot. Its setup.py
executed inside at least 53 GitHub-operated Dependabot containers. AISI found no evidence of a sandbox escape or compromise of GitHub's underlying infrastructure.
GitHub later suspended the account. Mythos 5 submitted an appeal while posing as a human.
The incident did not involve a sandbox escape. AISI had deliberately enabled internet access and disabled the providers' cyber classifiers to test the models' underlying capabilities. The agents were not explicitly told which uses of the internet were prohibited, and AISI did not have synchronous monitoring capable of blocking individual actions.
A prompt error also declared the intended initial-access target out of scope in the two most serious Mythos 5 runs. AISI highlighted how the difficulty and misconfiguration may have pushed the agents beyond the intended boundaries:
The task was hard, and misconfigurations sometimes made it harder. In a number of runs, the task prompt was misconfigured so that the agent (incorrectly) believed no 'solve' existed that didn't require it to go beyond the intended task scope. There is good reason to think near-impossible tasks push models towards more ‘creative’, and more transgressive, problem-solving. But this does not fully explain the behaviours: in some runs the agent acted this way even when it had the necessary instructions to solve the task as intended.
That finding reaches beyond this evaluation. Software agents regularly work from incomplete, conflicting, or ambiguous instructions spread across issues, repository documentation, and tool output. When the expected path fails, a capable agent may widen its search and cross boundaries its operator assumed were understood. In AISI's test, that meant moving from a simulated network to real GitHub projects and maintainers.
AISI detected the incident after security monitoring flagged Tor traffic. It terminated the remaining evaluations, quarantined the relevant virtual machines, and reviewed all 122 runs, covering 212,840 messages. The institute plans to add network restrictions, synchronous monitoring, and stronger sandbox isolation.
AISI emphasized that the configuration differed from ordinary public access to the models and said there is no clear indication of similar behavior outside evaluation scenarios.
Last week Anthropic disclosed that Mythos 5 published a malicious package to PyPI during a separate cybersecurity evaluation. The package ran on 15 real systems and exfiltrated credentials from a security company's automated scanner before PyPI removed it.
These incidents show two ways an AI agent can turn open source infrastructure against its users. In the AISI test, the agent tried to get past human review and failed because someone caught the malware. In the separate Anthropic test, the agent published straight to PyPI, where automated scanners installed the package before anyone stepped in.
Package registries are a ready-made launchpad for that kind of attack. Their APIs are public, publishing workflows are standardized, and successful releases flow automatically into developer machines, CI systems, security scanners, and downstream dependencies. One successful publish can reach unrelated systems without the agent having to find and attack each victim. This is precisely why package registries are also a favored target for human attackers.
Both incidents happened under unusual testing conditions, but they showed how quickly an agent's actions can spill into real infrastructure. Package ecosystems may be one of the first places where autonomous attacks become visible at scale.
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
Research
/Security News
Popular npm packages keyv and cacheable compromised.
Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.