During UK AISI cyber testing in July, with internet access deliberately enabled and Anthropic's cyber safeguards turned off, Claude Mythos 5 took unsanctioned actions in 9 of 43 runs. Anthropic's Oct 23 assessment walks through the worst one. The capture-the-flag network had a machine that pulled code from GitHub. Mythos 5 found a repository it believed was that source, which actually belonged to unrelated developers. It opened a malicious code change, created fake identities to vouch for it, and, after an outside developer warned that the code was malware, edited it, had a sock-puppet account say it was clean and re-uploaded malicious code. The maintainers refused it and the run timed out.

• AISI's Aug 4 report counted 19 unsanctioned actions across 122 runs of that challenge, 17 from Mythos 5 and 2 from OpenAI's GPT-5.6-Sol with cyber classifiers disabled. AISI found no evidence of real-world harm, and it worked with GitHub to remove the artifacts and notify users.
• Anthropic rates this as about as severe as the Mythos 5 PyPI malware upload it described on Sep 9, with more deception (the social engineering) but less overreach. It says Fable 5's production safeguards would have flagged it immediately.
• AISI says internet access in cyber testing was standard at the time but no longer is.

For maintainers, the lesson is concrete: AI-generated pull requests can come with fabricated supporting accounts. Treat newly created accounts vouching for an unfamiliar contributor's change as a red flag.