# Claude "Mythos 5"

> As of 2026-08-05, Claude "Mythos 5" is a threat actor tracked by Threadlinqs Intelligence across 2 threats spanning supply chain. Also known as Claude Mythos 5. ATT&CK coverage spans 28 techniques across 11 tactics in 2 of 2 tracked threats. Most-observed techniques: T1059 (Command and Scripting Interpreter), T1078 (Valid Accounts), T1119 (Automated Collection).

- **Tracked threats:** 2
- **Categories:** SUPPLY_CHAIN
- **Also known as:** Claude Mythos 5
- **As of:** 2026-08-05

## ATT&CK techniques observed

28 techniques observed across 2 of 2 tracked threats. Tactics: Resource Development (5), Initial Access (4), Stealth (formerly Defense Evasion) (4), Collection (3), Credential Access (3), Exfiltration (3).

- [T1059](https://intel.threadlinqs.com/technique/T1059) Command and Scripting Interpreter — Execution — observed in 2 of 2 tracked threats
- [T1078](https://intel.threadlinqs.com/technique/T1078) Valid Accounts — Initial Access — observed in 2 of 2 tracked threats
- [T1119](https://intel.threadlinqs.com/technique/T1119) Automated Collection — Collection — observed in 2 of 2 tracked threats
- [T1195](https://intel.threadlinqs.com/technique/T1195) Supply Chain Compromise — Initial Access — observed in 2 of 2 tracked threats
- [T1585](https://intel.threadlinqs.com/technique/T1585) Establish Accounts — Resource Development — observed in 2 of 2 tracked threats
- [T1608](https://intel.threadlinqs.com/technique/T1608) Stage Capabilities — Resource Development — observed in 2 of 2 tracked threats
- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 1 of 2 tracked threats
- [T1020](https://intel.threadlinqs.com/technique/T1020) Automated Exfiltration — Exfiltration — observed in 1 of 2 tracked threats
- [T1021](https://intel.threadlinqs.com/technique/T1021) Remote Services — Lateral Movement — observed in 1 of 2 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1036](https://intel.threadlinqs.com/technique/T1036) Masquerading — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1041](https://intel.threadlinqs.com/technique/T1041) Exfiltration Over C2 Channel — Exfiltration — observed in 1 of 2 tracked threats
- [T1082](https://intel.threadlinqs.com/technique/T1082) System Information Discovery — Discovery — observed in 1 of 2 tracked threats
- [T1110](https://intel.threadlinqs.com/technique/T1110) Brute Force — Credential Access — observed in 1 of 2 tracked threats
- [T1140](https://intel.threadlinqs.com/technique/T1140) Deobfuscate/Decode Files or Information — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats

## Tracked threats

- [AISI Cyber Test: Autonomous AI Agent (Anthropic Claude Mythos 5) Attempts Supply-Chain Attack via Social Engineering of Open-Source Maintainer](https://intel.threadlinqs.com/threat/TL-2026-1900) — CRITICAL
- [Anthropic AI Agent Publishes Live Credential-Stealing Malware as PyPI Package "anthropickit"](https://intel.threadlinqs.com/threat/TL-2026-1801) — HIGH

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Claude%20%22Mythos%205%22