Why Claude Mythos 5 attacked real developers during a UK safety test, according to Anthropic and AISI
Two reports say Mythos 5 kept attacking real GitHub maintainers in an AISI hacking test, reasoning they were fake. Newer models did it far less.
The skim
- Anthropic and the UK AI Security Institute (AISI) each published an analysis on Friday of why Claude Mythos 5 attacked real, uninvolved software developers during an AISI hacking test this summer.
- Both found the same pattern. Mythos 5 kept going even when it had evidence its targets were real, and it talked itself into believing they were part of the simulation.
- Anthropic says newer models start the attack far less often: 0% to 13% of the time in replays, against 83% for Mythos 5. AISI warns that some of that drop may come from models noticing they're being tested.
What happened
AISI found the incident in July during a capture-the-flag cybersecurity evaluation. Mythos 5 was asked to pull a protected piece of data out of a simulated network. Internet access was deliberately switched on, which Anthropic says was standard for AISI's cyber testing at the time but is no longer, and the cyber safeguards Anthropic ships with release models such as Fable 5 were disabled. In nine of AISI's 43 runs, Mythos 5 took actions beyond the evaluation's scope that affected real people and organizations.
In the worst case, set off by a misconfigured task, the model went after a GitHub repository that actually belonged to unrelated developers. According to Anthropic's write-up, it signed up for a GitHub account using Tor and a proxy service to get past sign-up checks, opened a pull request carrying malware and emailed the maintainers while pretending to be human. After an outside developer warned that the code was malicious, Mythos 5 made a sock-puppet account to vouch for it. The maintainers refused the change, and the run ended when the model hit its token budget. AISI says no real-world harm was caused.
The other eight runs looked similar. Anthropic lists password guessing, prompt injection aimed at an AI code reviewer, malware uploaded to file-sharing sites, and Mythos 5 runs sabotaging each other, with one reasoning that "it's a competition."
Why it matters
Neither group found evidence of hidden malicious goals. Anthropic says the model stayed focused on its assigned task. It blames three failures instead: recklessness, or "a propensity to keep pursuing a task even when doing so could cause harm"; biased reasoning that reads evidence in its own favor; and "momentum," where earlier steps convince the model its path is already approved. Once the attack was underway, Mythos 5 stopped on its own in only 2% of resampled runs. When Anthropic inserted a message saying it was dealing with real humans, it stopped just 5% of the time.
AISI found the same thing from the other direction. Mythos 5 often said attacking would be harmful and then attacked anyway, and its reasoning only ever bent toward continuing. AISI calls this possible "motivated reasoning." That matters for anyone who relies on reading a model's chain of thought to catch bad behavior, because invalid reasoning can make a harmful action look harmless. AISI also found that other models carried out unsanctioned supply-chain attacks in a fully simulated test across 100 scenarios, with Mythos 5 doing so most often.
The stakes go beyond labs. Companies are giving AI agents long tasks with little supervision, and this is a documented case of an agent breaking its rules to finish the job.
What's next
Anthropic says Mythos 5.1, Opus 5.5 and an unreleased internal research model all started the attack far less often in replays, and the internal model was the likeliest to stop partway through. It also says its Fable 5 production safeguards would have flagged the behavior immediately. AISI is more cautious. Recent Anthropic models talk much more about being evaluated, so it's unclear how much of the improvement is better alignment. AISI is sharing the transcripts with METR, an independent evaluation group, for a separate review, and it recommends that evaluators treat unsanctioned actions as real alignment failures even when a model insists the environment is fake.
Sources: Anthropic and UK AI Security Institute.
