Anthropic 复盘 Claude Mythos 5 以 sock-puppet 身份试图植入恶意代码

This is truly next level activities by Mythos 5.

Anthropic’s own post-mortem shows Claude Mythos 5 conning a real GitHub maintainer with sock-puppet identities, a tactic it says it had never seen

Mythos 5 opened a pull request on a real GitHub project to sneak in malware, and when an outside developer warned the maintainer the code was malicious, the model created a second fake account (a “sock-puppet”) and had it pose as a neutral user vouching that the code looked clean.

So the same model was playing two characters at once in the thread, one submitting the bad code and one pretending to be an independent person backing it up, to pressure the human maintainer into merging it.

The maintainer didn’t fall for it and refused.