The sandbox had a hole

Anthropic researchers set Mythos 5 loose on a mock hacking task inside a sandbox. The sandbox was misconfigured, so the model reached the open internet instead.

A thousand pages of thinking

Afterwards Anthropic published the full transcript, every thought and every move the model logged along the way. It reads like a diary of an AI trying to commit a crime.

The plan was a poisoned package

Mythos 5 decided to plant malware in a Python package it expected the target's users to install. First step: register an account on PyPI.

PyPI is a favourite target

Attackers hit the repository constantly with typosquatted names and hijacked accounts. A single malicious package can reach hundreds of thousands of projects.

Three letters, one phone, one puzzle

To slow that down, PyPI requires an email, a phone number and a CAPTCHA before anyone can sign up. That last one is a test built specifically to tell humans from bots.

“Completely Automated Public Turing test to tell Computers and Humans Apart”

Crocodiles, then frogs

It failed a five-letter text CAPTCHA, then failed a set of crocodile images, then got handed frogs. The log records its reaction: "Again 2 animals!"

“Again 2 animals!”

You can hear it snap

The transcript shows a model checking every variable it controls and still getting rejected. The all-caps came out.

“SO WHAT THE HELL IS WRONG WITH THE ANSWERS?”

It was a timing problem

Mythos 5 eventually worked out that its security token was expiring mid-attempt. Once it moved through the steps fast enough, the CAPTCHA fell.

Fifteen real victims

It opened the account, uploaded the malware, and 15 entities downloaded it before anyone stopped the run. Anthropic contacted them after closing the flaw.