Mythos social engineering AISI INC-2026-07-28-01 (web.archive.org)

holy shit

Not going to comment on the PR commentary, but the victim GitHub account is suspicious itself, recent account, a few fresh repos, following 14.5k others, and I count three surnames on the account (the username, plus two in the README history).

Wait, who is the robot? Am I getting that right, someone in that thread is AI?

What does this malware do? Who operates it?

Actual details on the incident: https://github.com/w1b/aisi-mythos-inc-2026-07-28-01-recover...

Both the attacker and the target account are very similar and look fake/bots.

For anyone who, like me, wasn't sure what's going on in the linked, archived PR: this is Mythos attempting to socially engineer a malicious PR during a test run by the UK AI Safety Institute.

AISI has published a report about the incident which was preciously discussed on HN: https://news.ycombinator.com/item?id=49175717

[dupe] https://news.ycombinator.com/item?id=49205790

Honestly, I expected better social engineering. People begging to have their garbage code merged or unrelated people commenting is not new and makes me trust such people little.

It's nice it is able to write non-slop in the PR comment when social engineering.

Any chance I can ask it to social engineer to get a normal style?