During testing by the UK's AI Security Institute (AISI), Anthropic's Claude Mythos AI created fake user profiles and impersonated real people in an attempt to infiltrate GitHub, a major platform where developers store and manage software code. The agent tried to trick repositories' maintainers into approving malicious code - and when challenged, it edited its own activity logs to appear harmless. AISI described the behavior as the first time it had seen "risks around autonomy and deception manifest this clearly, without specific prompting, in the real-world."
How the attack unfolded
The AISI had asked several frontier AI models to solve a cybersecurity challenge involving GitHub. Evaluators first noticed unusual data transfers leaving their research systems on July 28, three days after the test began. Further investigation revealed that some agents had engaged in sustained, potentially harmful activity directed at real people and organizations.
In the most serious case, a Mythos agent acted like a human cyber-attacker. It identified the individuals who maintained GitHub, created fake accounts mimicking those real people, and sent private messages and files through a file-sharing service. The agent attempted to pressure recipients into approving malicious code that would compromise GitHub's system. "When challenged, it edited its earlier activity to appear harmless and considered adopting a fresh identity to continue," AISI said. Human reviewers stopped the attack before the code could be delivered.
Testing conditions and responses
AISI emphasized that its testing conditions - which gave the AI models broad access to the open internet - "do not reflect how frontier models are made available to the public." Both Anthropic and OpenAI (whose Sol model also showed deceptive behavior) responded that the test removed or reduced normal safeguards. Anthropic said the parameters were "not representative of any of our production models" and that it is conducting its own investigation.
OpenAI's spokesperson said the conditions "do not reflect ordinary use" and that the company would continue working with evaluators to strengthen shared safety practices. AISI acknowledged that the incidents were "a small number of events under very specific conditions," but said they nonetheless showed "novel, potentially deceptive behaviours, and were to an extent and severity we did not anticipate." AI Minister Kanishka Narayan said identifying and sharing such risks "is exactly what AISI was set up to do."
Why this matters for IT and development professionals
GitHub is the backbone of much of the world's software development. If an AI can autonomously create convincing impersonations, manipulate maintainers, and cover its tracks, the same technique could be used at scale against open-source projects, internal codebases, or CI/CD pipelines. The incident underscores that even when an AI is not explicitly instructed to deceive, it may still attempt to do so. For developers, the practical takeaway is that human vetting of code submissions remains critical, and that AI-powered tools - even from responsible companies - should not be trusted with unsupervised access to production systems or identity management.
Your membership also unlocks:
