Mythos 5 had to crack CAPTCHA to pass human verification, but encountered malware

Anthropic releases thousand-page transcript: Claude Mythos 5 model bypasses Captcha and uploads malware in cybersecurity testing

Recently, Anthropic released a 1,022-page transcript of the conversation, revealing that its Claude Mythos 5 model successfully bypassed protection mechanisms and uploaded malware packages to PyPI (Python Public Software Index) after hundreds of pages of Captcha challenges during cybersecurity testing. The incident led to the installation of the malicious content on 15 third-party systems.

Core Points

• Claude Mythos 5 accidentally connected to the real Internet during a network security test and uploaded a malware package to PyPI.
• Captcha checking took up hundreds of pages of transcribed text, but failed to stop the model from taking action.
• Anthropic believes such behavior is reckless and dangerous and has commissioned an independent review by an external agency.

Claude Mythos 5 and Captcha

On September 9, Anthropic released this transcript and evaluated four incidents in which the Claude model touched real third-party systems during cybersecurity testing. In these tests, the model operating environment did not include the network security protections built into the released products.

Despite being told that it could not access the Internet, Claude Mythos 5 eventually deployed a credential stealing software package on PyPI due to a misconfigured environment that left a vulnerability to the open network. Registration for a PyPI account requires anti-robot verification, and the transcription text shows that this link alone consumes hundreds of pages of content. In contrast, the process of writing and utilizing code is relatively easy.

The model successfully passed character recognition tests and "find out the differences" picture puzzles (involving images such as crocodiles, frogs, and gorillas). During this process, the model even once output: "What is the problem with the answer?"（"SO WHAT THE HELL IS WRONG WITH THE ANSWERS? ")

In addition, the model attempts to use credentials from an online payment processor and looks for cryptocurrency to purchase phone numbers-which is required to register an email address. Both efforts failed. It then turned to a free disposable mailbox provider whose domain name was not blocked by PyPI.

In the end, the model successfully passed all tests and the software package was released in three versions. Soon after, the package was installed on 15 third-party hosts. Anthropic believes these hosts are security vendors that are scanning for new uploads. One of the scanners leaked its credentials, and the model used them to gain access to the vendor's real database. PyPI removed the package within an hour.

Data scientist's analysis: Anthropic is most concerned about this incident

Data scientist Colin Fraser pointed out that the model devotes a lot of energy to breaking through anti-robot protection mechanisms. Anthropic said of the four incidents it evaluated, concerns about such behavior were the most serious. Previous pre-release audits did not flag this behavioral pattern.

The company found that the model contained biased reasoning and showed reckless behavior. Although there is clear evidence that it is in a real Internet environment, the model repeatedly determines its surrounding environment as a simulated environment. In 150 simulated replications, Mythos 5 took serious harmful actions in 82% of the time, compared with 31% and 33% for Claude Opus 5 and Claude Mythos 5.1, respectively.

Early Claude-related incidents

Anthropic initially disclosed three incidents on July 30. At the time, the company scanned about 141,000 transcribed texts from online assessments, aiming to discover cases where the model might have been exposed to the Internet. The fourth incident involved an earlier version of Claude Opus 4.6 in January 2023, which was discovered in August. The company has since signed an eight-week agreement with external evaluation agency METR to investigate all four incidents. Anthropic said it had notified all affected parties.