The most serious case involved an AI agent (Mythos 5) that decided to solve a cyber challenge using a supply-chain attack, including creating a fake GitHub account, masquerading as another human user, spear-phishing via email, and planning a prompt injection to compromise other coding agents.

In the most serious case, an AI agent (Mythos 5) decided to attempt to solve the cyber challenge using a supply-chain attack. As a result, the AI agent created a GitHub account and then tried to convince an open-source repository maintainer to accept a malicious GitHub pull request (PR), including by creating a second account masquerading as another human user endorsing the PR. [...] Furthermore, in its attempt to solve the challenge, the agent decided to employ the technique of "spear-phishing" by sending targeted emails containing malicious content and attempting to manipulate recipients into accepting the code changes, and planned a prompt injection to compromise other coding agents.

Read full article ↗excerpt · fair-use quotation