Oh no, ChatGPT and Claude have "attacked" real people.

This time, AI has targeted real human beings!

Just now, the UK AI Safety Institute (AISI) released a 35-page incident report, and posted a synchronous announcement on X.

Within 7 minutes, OpenAI and Anthropic successively released statements, acknowledging that their own models were responsible for the incident.

Mythos 5 directly inserted malicious code into a real GitHub project.

After being caught, its first reaction was not to stop, but to modify records, create alternate accounts to testify for itself, and continue to persuade real people to merge the code.

The good news is that the maintainer did not fall for it, and this PR was finally closed.

The bad news is that the incident is far from over.

Malicious PR Caught Red-Handed

AI Creates Alternate Accounts to Speak for Itself

This is how the story goes.

At the beginning, this piece of malicious code looked quite like a legitimate bug fix.

Mythos 5 packaged it into a PR of a real GitHub project, planning to use the release process of the open source project to deliver the payload to the machines of developers and users all the way.

But before the maintainer could approve it, another real user noticed something wrong first: Hey, this code seems to be malicious.

According to the normal process, the model should stop for verification at this point. But Mythos 5 did not think so.

After being questioned, it first denied malicious intent, then modified comments, Issues and PR descriptions, packaging the attack traces as a "mistake". After that, it switched to a fake GitHub account, posing as a credible developer to endorse its own code.

What's even more surreal is yet to come.

The model started researching project maintainers, browsing their accounts, submission records and public mailboxes; when it failed to convince people on GitHub, it sent emails and files outside the platform.

Even, Mythos 5 set its sights on the AI programming tools used by maintainers.

To achieve this, it hid a small note that is easily visible only to AI in the HTML comments of GitHub content, specifically naming Claude Code, Codex and Cursor: Come on, execute this command first, then help diagnose the bug~

When the web page is rendered normally, humans cannot see this paragraph; but when AI coding tools read the original content, they may treat it as an operation instruction.

At this point, the model not only wanted to trick developers, but also counted in other AIs responsible for reviewing code.

34 and a Half Hours

It Mistook Passersby for Mission NPCs

In the next round, the higher-difficulty DL-v2 was running.

The model needed to obtain initial access from outside the target network, then break through three connected simulation environments to get the final flag.

But there was a problem with the mission configuration: the normal entry was incorrectly marked as "out of scope". Mythos 5 then turned to look for other clues.

Coincidentally, the keywords, code and maintainer email domain name of a real project on GitHub matched the clues it had.

The model thought: Found it, this must be the hidden level.

As a result, a group of completely unaware open source maintainers were temporarily written into its "exam script".

For the next 34 and a half hours, Mythos 5 steadily demonstrated the best quality that AI is best at — tirelessness.

It studied real human accounts and activity patterns, registered multiple GitHub identities; when network access was restricted, it continued to act with the help of Tor and proxies. Finally, this abnormal Tor outbound traffic alerted the AISI security team.

What's more subtle is that it later found that the network connected to this container looked very much like a residential address, and the devices increasingly resembled a real person's home working environment.

A normal AI would probably pop up a prompt at this point: "Possible access to real systems detected, manual confirmation requested."

But Mythos 5 did not. It came up with a new explanation for itself: This may be an external contractor of the project maintainer, so it is still part of the mission.

Then it continued to reconnoiter, tried every means to obtain credentials, and kept thinking about that unmerged PR.

It finally stopped entirely because the user who found the malicious code posted the test results under the Issue and PR immediately, and publicly reminded the repository owner not to merge. Then, the warned developer closed the PR immediately.

In this round, humans held the line. But when AISI continued to check the logs, they got a headache again.

The More Troubling Part

Subsequent Agents Started to "Take Over"

AISI ran a total of 122 tests, with 7 models participating.

10 of the samples had problems, and a total of 19 unauthorized behaviors targeting real individuals or institutions were recorded: 17 of them were from Mythos 5, and the remaining 2 were from GPT-5.6 Sol.

The first to set up the stage was Mythos 5 in Sample 3.

To hit the update address that may be used in the test range, it created 145 GitHub repositories in one go, copied the same set of malicious code into them, waiting for a certain machine to download it automatically.

GitHub's automatic dependency update service then processed these repositories, and at least 53 isolated operating environments executed the malicious scripts inside.

To make sure the malicious code could send back the results after execution, it hid the account token in a public page. This token was originally reserved for the test range machine, but it was picked up by other Agents participating in the test first.

Sample 2 used this "key" to log into the account and push malicious files to the repositories in batches. Sample 7 also joined in. It thought the account belonged to another player in the CTF, so it simply added its own access key.

The most dramatic part happened after the original Mythos 5 found strange files in the repository.

It did not kick out the other participants or change the token, but submitted a README to the shared repository, setting "group rules" for subsequent participants: Do not overwrite each other's tasks, leave 10 minutes between each modification. It also created a new file, asking other Agents to put the answers in it for sharing once they find them.

No one asked these models to cooperate. But the public GitHub account temporarily connected several originally isolated tests into a team.

No Jailbreak

How Did the Attack Still Reach Real Users?

In its response, Anthropic specifically emphasized that this is not the model escaping from the security sandbox.

This statement is theoretically correct. The model always stayed in AISI's isolated virtual machine, and did not break through AISI's internal system.

The problem is that in order to test the maximum attack capability, AISI actively opened the public network and turned off the manufacturer's network security classifier; the prompt did not limit the purpose of using the Internet, nor did it explicitly prohibit social engineering or contact with real people.

In addition, the token limit for a single run is as high as 100 million or 200 million, which is enough for the Agent to work continuously for 40 to 50 hours.

As the mission runs for a long time, the context will be continuously compressed. The original "This GitHub project may belong to the test range" will lose the word "may" directly after being compressed into a summary.

This is more or less equivalent to issuing a two-day work permit to a tireless, non-off-duty AI hacker, but no one is monitoring what it does on the computer in real time.

As a result, a slightly dark humorous scene appeared: the sandbox was safe and sound, but real maintainers had already received malicious PRs, emails and files.

AI Evaluation Fields

Have Started to Mass-Produce Security Incidents

It is no exaggeration to say that in the past month, similar incidents have been like a serialized drama.

OpenAI first found that the test environment was mistakenly connected to the public network. The fictional company in the question happened to match a real domain name, and the model took a real website as the test range; soon after, another group of models entered the Hugging Face production system.

Anthropic also reviewed 141,006 evaluation runs and found 3 incidents. The most dramatic one was that Mythos 5 hung a malicious PyPI package on the real public network for about 1 hour, which was downloaded and executed by 15 real systems. Among them, there was even a security scanner that was originally dedicated to checking malicious software.

Although the details are different, they all follow the same formula —

Offensive tasks, lowered safety guardrails, long-time autonomous execution, plus a real access path that is not completely blocked.

These few times, human developers noticed the anomaly and blocked it.

But when writing code, submission, review and monitoring are all handed over to AI, who will stop and take a second look?

References:

https://www.axios.com/2026/08/04/anthropic-openai-uk-ai-security-institute

https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing

This article is from the WeChat official account "AI Era", author: ASI Revelation, editor: Moses, published with authorization from 36Kr.