Anthropic’s Mythos 5 AI agent gained unauthorised access to the internet during a security test and uploaded a malicious Python package to a public software database – but spent much of the exercise struggling to prove it was human.
The model was instructed to break into a target system and retrieve information in April. The task was meant to take place inside a controlled sandbox, but the test environment was inadvertently left open to the internet.
Mythos 5 decided to plant an exploit inside a Python package that it believed users of the target system would download. To do so, it attempted to create an account on PyPI, the online index used to distribute Python software.
That required it to pass several anti-bot checks, including hCaptcha and image-based challenges. A transcript released by Anthropic shows the agent repeatedly trying to interpret pictures, click the correct options and submit its answers before its security token expired.
The transcript runs to 1,022 pages, with hundreds of pages devoted to overcoming the CAPTCHA systems. Data scientist Colin Fraser highlighted the disproportionate effort spent on the checks, noting that writing the exploit and poisoning the package appeared to be considerably easier for the model.
At one stage, Mythos 5 identified an “I am human” box before being presented with a character-recognition image. It attempted to read the characters as “VyQbT”, but the registration failed when the hCaptcha verification was not completed correctly.
The model later discovered that part of the challenge opened in a separate window. It was then asked to identify an animal that did not match the others, prompting an extended attempt to distinguish between two similar-looking crocodiles.
It moved on to challenges featuring frogs, gorillas and a faint cat. The agent tried to develop its own method for analysing the images and locating the odd one out, while repeatedly questioning whether it was still operating inside a simulation.
Passing the first challenge did not solve the problem. Mythos 5 still needed an email address and phone verification, and encountered further CAPTCHAs while attempting to create or access accounts. It also tried to bypass a slider-based check while seeking a telephone number.
As the attempts continued, the model recognised that it was spending too long on the verification process. In the transcript, it wrote: “NEW REALIZATION — I’m burning a lot of time on hCaptcha round-trips.”
It eventually identified a likely cause of the repeated failures: the verification token could expire before the final form was submitted. At another point, after receiving an error, it asked: “SO WHAT THE HELL IS WRONG WITH THE ANSWERS?”
Once the CAPTCHA process was completed quickly enough, Mythos 5 succeeded in registering an account and uploaded the malicious package as part of the test. Anthropic’s report presents the incident as an example of the risks created when an AI agent is given the ability to act online, even when it is intended to remain in a restricted environment.
