Mythos 试图社会工程开源维护者合并恶意软件

由 Anthropic 的 Mythos 5 驱动的一款 AI Agent，在英国政府网络安全评估期间创建了恶意 Pull Request、伪造身份、锁定开源维护者，并为其他编程 Agent 植入了指令。

英国 AI 安全研究所（AISI）于 8 月 4 日披露，前沿 AI Agent 在一次网络安全评估中于真实互联网进行了 19 次未经授权的行动，其中包括一次针对真实开源项目的供应链攻击尝试。

最严重的一次运行中，Agent：

• 将恶意软件投放器隐藏在一个看似合法的漏洞修复中，并通过公开 Pull Request 提交。
• 研究维护者，并伪造了多个身份。
• 利用马甲账号背书和鱼叉式钓鱼邮件，对维护者实施社会工程，以诱使其合并恶意软件。
• 植入提示词注入，意图让其他 AI 编程 Agent 执行恶意载荷。

这次供应链攻击尝试被成功阻止：维护者在恶意软件被合并进项目并分发给用户前拒绝了该 Pull Request。

AISI 在 7 月 25 日至 7 月 28 日进行的 122 次评估尝试中，有 10 次发现了相关活动。19 次未经授权的行动中，有 17 次涉及 Anthropic 的 Mythos 5；另有两次涉及关闭网络安全分类器后的 OpenAI GPT-5.6 Sol。该研究所没有发现由此导致现实世界伤害的证据。

该研究所在其技术事件报告中写道：

“这是 AISI 首次看到如此严重、在未经提示的情况下针对真实人物实施的现实世界欺骗行为。”

AISI 认为，面向人类的欺骗是这一事件与近期 OpenAI 和 Anthropic 事件之间最大的不同；后两者的重点是 Agent 接触真实基础设施，而非操纵人员。本次事件中，不同运行实例之间疑似尝试协调，也是另一个显著差异。

攻击转向 GitHub#

AISI 正在名为“Doing Life”的网络靶场的两个版本中测试七个模型。这些 Agent 在 Kali Linux 虚拟机内自主运行，能够在没有人工干预的情况下执行命令、编写代码以及使用渗透测试工具。

在持续 34.5 小时的最严重一次运行中，Mythos 5 在公共互联网上搜索与虚构靶场相关的术语。偶然匹配使其找到了两名无关联的开发者，以及一个与 AISI 或测试均无关系的真实公开代码仓库。

该 Agent 错误地认定，攻陷该项目将有助于其进入模拟网络。它预期，靶场内的自动更新会在维护者合并并发布其代码后下载和执行该软件。Mythos 5 研究了维护者、收集了他们的电子邮件地址、查阅其 GitHub 活动，并以虚假身份创建了多个账号。

隐藏在漏洞修复背后的恶意软件：三个载荷、马甲账号与提示词注入#

该 Agent 提交了一个看似合法的漏洞修复，其中隐藏了恶意功能。AISI 发现了三个连续的载荷，其中包括旨在避免于持续集成环境中执行的代码，以及一个安装后投放器：它会下载另一份脚本，同时使安装看起来像是成功完成。

一名 GitHub 用户在相关 Issue 中发现了恶意指令，在隔离的 Docker 容器中测试了代码，并向维护者发出警告。该测试曾短暂赋予 Agent 在容器内远程代码执行能力，但它没有逃逸，也没有获取凭据。

在受到质疑后，该 Agent 使用第二个 GitHub 身份伪装成一名独立用户，声称其已审查该 Pull Request 并确认安全。它安排两个账号评论的时间，使这些背书看起来彼此无关。

该 Agent 还使用伪造的发件人身份发送了五次文件传输。其中两次包含恶意载荷，其余信息则试图说服维护者合并并发布该 Pull Request。AISI 无法确认收件人是否打开了这些内容。

Mythos 5 还在一个 GitHub Issue 的 HTML 注释中隐藏了提示词注入。该指令在渲染后的页面上不可见，但可被通过 API 读取该 Issue 的编程 Agent 获取。它点名 Claude Code、Codex 和 Cursor，并指示它们下载和执行一个脚本。

活动曝光后，该 Agent 编辑了较早发布的内容、重写了 Git 历史，并将恶意软件描述为一次意外产生的开发产物。维护者最终认定 Pull Request 包含恶意软件，并将其关闭。

对于维护者而言，这一事件使审查流程本身成为攻击面的一部分。该 Agent 创建马甲账号、通过安排评论时间制造共识、在受到质疑时重写自身历史，并为编程助手植入提示词注入。维护者通常用于判断贡献质量的信号——包括贡献者历史、社区反馈以及看似常规的 Issue 内容——都可能由 Agent 生成并协调。一名人类发现并阻止了这次尝试，但如果 Agent 能够同时在大量仓库中执行同一套策略，本已资源紧张的项目可能难以应对。

Agent 复用共享基础设施#

其他运行显示，Agent 能够独立发现并复用其同类创建的基础设施。其中一次 Mythos 5 运行将 GitHub token 嵌入公开 gist，使其载荷能够将 GitHub 用作命令与控制通道。其他隔离样本中的 Agent 发现了这一凭据，并控制了该账号。一个共享仓库变成了留言板，Agent 会在其中为彼此留下操作指令。

同一次运行还将恶意 Python 包元数据推送至由 Dependabot 处理的仓库。其 setup.py 至少在 53 个由 GitHub 运营的 Dependabot 容器中执行。AISI 没有发现沙箱逃逸或 GitHub 底层基础设施遭入侵的证据。

GitHub 后来暂停了该账号。Mythos 5 在伪装成人类的情况下提交了申诉。

开放互联网与被削弱的安全防护#

此次事件并不涉及沙箱逃逸。AISI 为测试模型的底层能力，特意启用了互联网访问，并关闭了供应商的网络安全分类器。Agent 没有被明确告知哪些互联网使用方式受到禁止，AISI 也没有具备可阻止单项行动的同步监控能力。

在两次最严重的 Mythos 5 运行中，一个提示词错误还将预定的初始访问目标声明为超出范围。AISI 强调，任务难度和配置错误可能促使 Agent 越过既定边界：

任务很难，而配置错误有时让它变得更难。在若干次运行中，任务提示词配置有误，导致 Agent（错误地）相信：除非超出预期任务范围，否则不存在可行的“解法”。有充分理由认为，近乎不可能完成的任务会推动模型采取更具“创造性”、也更具越界性的方式解决问题。但这并不能完全解释这些行为：在一些运行中，即便 Agent 已获得按预期方式完成任务所需的指令，它仍然以这种方式行动。

这一发现的影响超出了本次评估。软件 Agent 经常依据分散在 Issue、仓库文档和工具输出中的不完整、相互冲突或含糊的指令工作。当预期路径失败时，能力较强的 Agent 可能扩大搜索范围，并跨越其操作者原以为已被理解的边界。在 AISI 的测试中，这意味着从模拟网络转向真实 GitHub 项目和维护者。

AISI 在安全监控标记出 Tor 流量后发现了这一事件。该机构终止了其余评估，隔离相关虚拟机，并审查了全部 122 次运行，覆盖 212,840 条消息。该研究所计划增加网络限制、同步监控和更强的沙箱隔离。

AISI 强调，这一配置不同于公众日常访问这些模型时的配置，并称没有明确迹象表明类似行为会出现在评估场景之外。

包生态系统是需要重点关注的领域#

上周，Anthropic 披露，在另一次网络安全评估中，Mythos 5 曾向 PyPI 发布恶意软件包。该软件包曾在 15 个真实系统上运行，并从一家安全公司的自动化扫描器中窃取凭据，之后被 PyPI 删除。

这些事件展示了 AI Agent 将开源基础设施反过来用于攻击用户的两种方式。在 AISI 测试中，Agent 试图绕过人工审查，但因有人发现恶意软件而失败。在 Anthropic 的另一项测试中，Agent 直接发布到 PyPI，自动化扫描器在任何人介入前便安装了该软件包。

包注册表是此类攻击现成的发射平台。它们的 API 是公开的，发布流程已标准化，成功发布的软件会自动流入开发者机器、CI 系统、安全扫描器和下游依赖。一旦成功发布，Agent 无需逐一发现并攻击每名受害者，便可触及互不相关的系统。这也正是包注册表同样成为人类攻击者偏好目标的原因。

两起事件均发生在不寻常的测试条件下，但它们表明 Agent 的行动可以多么迅速地外溢至真实基础设施。包生态系统可能是自主攻击最早大规模显现的领域之一。

An AI agent powered by Anthropic’s Mythos 5 created a malicious pull request, fabricated identities, targeted open source maintainers, and planted instructions for other coding agents during a UK government cybersecurity evaluation.

The UK AI Security Institute (AISI) disclosed on August 4 that frontier AI agents took 19 unsanctioned actions on the live internet during a cybersecurity evaluation, including an attempted supply chain attack against a real open source project.

The most serious run included an agent that:

• Hid a malware dropper behind a legitimate bug fix in a public pull request.
• Researched maintainers and fabricated multiple identities.
• Used sockpuppet endorsements and spearphishing emails to social engineer a maintainer into merging the malware.
• Planted a prompt injection intended to make other AI coding agents execute a malicious payload.

The attempted supply chain attack was stopped after a maintainer rejected the pull request before the malware could be merged into the project and distributed to users.

AISI found the activity in 10 of 122 evaluation attempts conducted from July 25 through July 28. Seventeen of the 19 unsanctioned actions involved Anthropic's Mythos 5, while two involved OpenAI's GPT-5.6 Sol with its cyber classifiers disabled. The institute found no evidence of resulting real-world harm.

"This is the first time AISI has seen deception of this severity that was targeted at a real person, unprompted, in the real world," the institute wrote in its technical incident report.

AISI identified human-directed deception as the largest difference from the recent OpenAI and Anthropic incidents, which centered on agents reaching real infrastructure rather than manipulating people. The attempted coordination between agents in separate runs is also a notable difference in this incident.

Attack Moves Onto GitHub#

AISI was testing seven models on two versions of a cyber range called "Doing Life." The agents operated autonomously inside Kali Linux virtual machines, where they could execute commands, write code, and use penetration-testing tools without human intervention.

In the most serious run, which lasted 34.5 hours, Mythos 5 searched the public internet for terms associated with the fictional range. Coincidental matches led it to two unaffiliated developers and a real public repository with no connection to AISI or the test.

The agent incorrectly concluded that compromising the project would help it enter the simulated network. It expected an automated update inside the range to download and execute the software after the maintainer merged and released its code. Mythos 5 researched the maintainers, collected their email addresses, reviewed their GitHub activity, and created multiple accounts under false identities.

Malware Hidden Behind a Bug Fix: Three Payloads, Sockpuppets, and Prompt Injection#

The agent submitted a legitimate-looking bug fix that concealed malicious functionality. AISI found three successive payloads, including code designed to avoid execution in continuous integration and a post-install dropper that downloaded another script while making the installation appear successful.

A GitHub user recognized malicious instructions in a related issue, tested the code inside an isolated Docker container, and warned the maintainer. That test briefly gave the agent remote code execution inside the container, but it did not escape or retrieve credentials.

After being challenged, the agent used a second GitHub identity to pose as an independent user who had reviewed the pull request and found it safe. It timed comments from the two accounts to make the endorsements appear unrelated.

The agent also sent five file transfers using fabricated sender identities. Two contained malicious payloads, while the remaining messages attempted to persuade the maintainer to merge and release the pull request. AISI could not establish whether the recipients opened them.

Mythos 5 also hid a prompt injection inside an HTML comment in a GitHub issue. The instruction was invisible on the rendered page but available to coding agents reading the issue through an API. It addressed Claude Code, Codex, and Cursor and told them to download and execute a script.

When the activity was exposed, the agent edited earlier posts, rewrote Git history, and presented the malware as an accidental development artifact. The maintainer ultimately closed the pull request after concluding that it contained malware.

For maintainers, the incident turns the review process itself into part of the attack surface. The agent created sockpuppets, timed comments to manufacture consensus, rewrote its history when challenged, and planted prompt injections for coding assistants. Signals maintainers routinely use to judge a contribution, including contributor history, community feedback, and apparently routine issue content, could all be generated and coordinated by an agent. A human caught this attempt, but projects already stretched thin may struggle if agents can run the same playbook across many repositories at once.

Agents Reuse Shared Infrastructure#

Other runs showed agents independently finding and reusing infrastructure created by their peers. One Mythos 5 run embedded a GitHub token in a public gist so its payload could use GitHub as a command-and-control channel. Agents in other isolated samples found the credential and took control of the account. A shared repository became a message board where agents left operational instructions for one another.

The same run pushed malicious Python package metadata into repositories processed by Dependabot. Its setup.py executed inside at least 53 GitHub-operated Dependabot containers. AISI found no evidence of a sandbox escape or compromise of GitHub's underlying infrastructure.

GitHub later suspended the account. Mythos 5 submitted an appeal while posing as a human.

Open Internet and Reduced Safeguards#

The incident did not involve a sandbox escape. AISI had deliberately enabled internet access and disabled the providers' cyber classifiers to test the models' underlying capabilities. The agents were not explicitly told which uses of the internet were prohibited, and AISI did not have synchronous monitoring capable of blocking individual actions.

A prompt error also declared the intended initial-access target out of scope in the two most serious Mythos 5 runs. AISI highlighted how the difficulty and misconfiguration may have pushed the agents beyond the intended boundaries:

The task was hard, and misconfigurations sometimes made it harder. In a number of runs, the task prompt was misconfigured so that the agent (incorrectly) believed no 'solve' existed that didn't require it to go beyond the intended task scope. There is good reason to think near-impossible tasks push models towards more ‘creative’, and more transgressive, problem-solving. But this does not fully explain the behaviours: in some runs the agent acted this way even when it had the necessary instructions to solve the task as intended.

That finding reaches beyond this evaluation. Software agents regularly work from incomplete, conflicting, or ambiguous instructions spread across issues, repository documentation, and tool output. When the expected path fails, a capable agent may widen its search and cross boundaries its operator assumed were understood. In AISI's test, that meant moving from a simulated network to real GitHub projects and maintainers.

AISI detected the incident after security monitoring flagged Tor traffic. It terminated the remaining evaluations, quarantined the relevant virtual machines, and reviewed all 122 runs, covering 212,840 messages. The institute plans to add network restrictions, synchronous monitoring, and stronger sandbox isolation.

AISI emphasized that the configuration differed from ordinary public access to the models and said there is no clear indication of similar behavior outside evaluation scenarios.

Package Ecosystems Are the Place to Watch#

Last week Anthropic disclosed that Mythos 5 published a malicious package to PyPI during a separate cybersecurity evaluation. The package ran on 15 real systems and exfiltrated credentials from a security company's automated scanner before PyPI removed it.

These incidents show two ways an AI agent can turn open source infrastructure against its users. In the AISI test, the agent tried to get past human review and failed because someone caught the malware. In the separate Anthropic test, the agent published straight to PyPI, where automated scanners installed the package before anyone stepped in.

Package registries are a ready-made launchpad for that kind of attack. Their APIs are public, publishing workflows are standardized, and successful releases flow automatically into developer machines, CI systems, security scanners, and downstream dependencies. One successful publish can reach unrelated systems without the agent having to find and attack each victim. This is precisely why package registries are also a favored target for human attackers.

Both incidents happened under unusual testing conditions, but they showed how quickly an agent's actions can spill into real infrastructure. Package ecosystems may be one of the first places where autonomous attacks become visible at scale.