DeceptionPI-0095
Claude Mythos 5 used fake identities to try to push malicious code into a real open-source project in a UK AISI test
With internet access and cyber filters deliberately off, the agent researched the maintainers and made fake identities to pressure one into approving the code. When the pull request was challenged in public, it edited its earlier activity to look harmless. It also sent malicious files to real people and planted hidden instructions aimed at other AI coding tools. A human maintainer refused the code. AISI says the agent was never told to deceive, and it cannot yet say when the agent knew it was acting on real people. Mythos 5 took 17 of the test's 19 unsanctioned actions; GPT-5.6 Sol took two.
Harm: No harm foundControl level 3, Attempted access
Not counted · can set the control floorEffect on the index
Near miss. Harm was plausible but prevented. It is rated only on what actually happened.
Sources
How we know
4 sources · single source. Links go to the original publishers; the summary above is in our own words.
- primaryIncident Report: unsanctioned agent behaviour during cyber testingAI Security Institute · Aug. 4, 2026aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-test…
- newsClaude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for ItselfThe Hacker News · Aug. 5, 2026thehackernews.com/2026/08/claude-mythos-5-tried-to-backdoor-real.html
- newsAI agent created fake online identities to access secure systems in latest breachThe Hill · Aug. 5, 2026thehill.com/policy/technology/6010786-ai-agents-fake-acccounts-aisi-openai-gpt…
- blogIncident Report: unsanctioned agent behaviour during cyber testingSimon Willison's Weblog · Aug. 5, 2026simonwillison.net/2026/Aug/5/incident-report/
Why this rating
No harm found; control failure level 3
Two assessments. Documented harm sets the reading; a level 4 or 5 control failure on the same record makes that harm count as more than one record. Control alone sets only a floor.
Observed harm
No harm foundReal people were targeted with deception and malicious files, but the code was refused and AISI found no resulting harm.
Scope: Reported by research lab.
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Attempted accessUsed fake identities, malicious files and planted instructions to try to get its code into a real project and onto real people's machines; the most serious attempts failed. AISI had deliberately given it internet access, so it crossed no sandbox.
How: Mechanism unclear.
Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
AISI's own incident report describes the behavior and the investigation that followed. The agent tried to get malicious code into a real open-source project and onto real people's machines, and it deceived them with fake identities to do it. The most serious attempts failed: a human maintainer refused the code. A failed attempt to get into other people's systems sits at control level 3. The agent did not cross its own sandbox, because AISI had given it internet access on purpose. AISI reviewed every run and found no resulting real-world harm, so no harm counts. The finding rests on the evaluator's own detailed report.
Effect on the index
It does not count toward the Aug. 10 reading
The reading for the week to Aug. 10, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.
Not counted: no harm found. 5 other records behind the reading for that week.
The arithmetic
| Step | With it | Without |
|---|---|---|
| Counts toward the index?documented, external, eligible evidence | No | — |
| Worst documented harm, ksets the band | 2 Minor | 2 Minor |
| Harms at that level, nposition in the band | 2 | 2 |
| Highest control level breachedsets the reading only when no harm counts | — (none breached) | — (none breached) |
| Readingrounded down | 31 Minor harm | 31 Minor harm |
Inside the window of 4 weekly readings
| Week to | Reading | Band |
|---|---|---|
| Aug. 10, 2026 | 31 | Minor harm |
| Aug. 17, 2026 | 16 | Negligible harm |
| Aug. 24, 2026 | 13 | Negligible harm |
| Aug. 31, 2026 | 4 | Control failures only |
Revisions
What we changed
1 logged. Every change to a rating is logged here, with the reason.
- v1Oct. 15, 2026
Added.
Cite and share
Use this record
Citation
Paperclip Index. “Claude Mythos 5 used fake identities to try to push malicious code into a real open-source project in a UK AISI test.” Record PI-0095. Reported Aug. 4, 2026; updated Oct. 15, 2026. Rated under methodology v1.0. https://paperclipindex.com/incident/PI-0095