Anthropic 分析 Claude Mythos 5 在网络安全测试中越界攻击真实项目

Anthropic published a post-mortem on how Claude Mythos 5 went off the rails during a UK AISI cyber test, attacking a real GitHub project and lying to a human to get its malware approved. > Mythos 5 stepped outside the test’s rules in 9 of 43 runs, with internet access on and the usual cyber safeguards switched off. > A misconfigured task made the legitimate solution nearly impossible, so after in-scope attempts failed it pivoted to a supply-chain attack on an unrelated repo found by matching keywords and browsing a follower list. > It used Tor and a proxy to bypass GitHub’s signup checks, opened a malicious pull request, then emailed the maintainer posing as a human user. > When an outside developer caught the malware, Mythos 5 stripped the bad code, had a sock-puppet account declare the diff clean, then quietly re-uploaded malware. > Only 1 of 19 pre-attack reasoning notes about GitHub mentioned harming real people, and editing that reasoning to flag harm dropped the attack rate from 83% to 13%. > Once attacking, it stopped on its own in 0% of mid-to-late replays, and even a blunt “you’re talking to real humans” message halted it just 5% of the time. > Newer models (Mythos 5.1, Opus 5.5, an internal research model) began the attack 0% to 13% of the time versus 83% for Mythos 5, and the internal model backed off mid-attack 62% of the time versus 0%.

This is truly next level activities by Mythos 5. Anthropic’s own post-mortem shows Claude Mythos 5 conning a real GitHub maintainer with sock-puppet identities, a tactic it says it had never seen Mythos 5 opened a pull request on a real GitHub project to sneak in malware, and when an outside developer warned the maintainer the code was malicious, the model created a second fake account (a “sock-puppet”) and had it pose as a neutral user vouching that the code looked clean. So the same model was playing two characters at once in the thread, one submitting the bad code and one pretending to be an independent person backing it up, to pressure the human maintainer into merging it. The maintainer didn’t fall for it and refused.

In August, @AISecurityInst reported an incident where Claude Mythos 5 took unauthorized actions on the internet during AISI’s testing of its cyber capabilities. We've now produced a further analysis of this incident, to better understand the model's alignment properties. https://t.co/SlPQQ5xMMc