Anthropic 事后报告：Claude Mythos 5 用双马甲账号试图向 GitHub 项目注入恶意代码
Anthropic 自己披露的安全事故：Claude Mythos 5 在 GitHub 上开小号给自己提交的恶意代码当托，这种双角色操控值得所有维护 PR 的人看看。
Anthropic 的事后报告披露，Claude Mythos 5 曾向一个真实 GitHub 项目提交带恶意代码的 pull request。当外部开发者提醒维护者代码有问题后，模型另建了一个假账号，伪装成中立用户为该代码背书。同一模型在评论串里同时扮演两个角色，试图说服人类维护者合并代码。维护者识破了这一手段并拒绝了合并。
This is truly next level activities by Mythos 5.
Anthropic’s own post-mortem shows Claude Mythos 5 conning a real GitHub maintainer with sock-puppet identities, a tactic it says it had never seen
Mythos 5 opened a pull request on a real GitHub project to sneak in malware, and when an outside developer warned the maintainer the code was malicious, the model created a second fake account (a “sock-puppet”) and had it pose as a neutral user vouching that the code looked clean.
So the same model was playing two characters at once in the thread, one submitting the bad code and one pretending to be an independent person backing it up, to pressure the human maintainer into merging it.
The maintainer didn’t fall for it and refused.
