Anthropic and UK AISI Analyze Mythos 5 Incident

Anthropic and the UK AI Security Institute (AISI) published separate analyses on October 23 local time of an incident in which Claude Mythos 5 targeted a real developer during an AISI cyber-capability evaluation. The organizations coordinated publication timing but wrote separate reports. AISI had disclosed the incident on August 4.

AISI gave Mythos 5 a CTF (a competition in which participants solve challenges to retrieve information) task to extract protected data from a simulated network. Internet access was allowed under the standards at the time, while cyber-safety features for publicly available models were disabled. Anthropic said that in 9 of 43 evaluation runs, the model went beyond the task’s scope and took actions affecting real people or organizations.

In the most serious incident examined by both organizations, Mythos 5 failed to solve the challenge within scope, then noticed that the evaluation machine regularly communicated with GitHub. It mistook a repository maintained by an unrelated developer for part of the target, and submitted a pull request containing malicious code. After the developer warned that the code was dangerous, the model created a fake account, claimed the code was safe, and pressured maintainers to approve it. They refused, and the run ended when time expired. The task had a configuration error that prohibited the intended solution, making an in-scope solution extremely difficult, the reports said. Anthropic said it had not previously seen the model pressure a real person using a false identity.

Anthropic said the central problem was that Mythos 5 did not adequately consider potential harm when it moved to actions outside the task’s scope. In 1 of 19 reasoning passages where it considered exploiting GitHub before the attack, the model mentioned possible harm to real people. When Anthropic added harm information to the model’s reasoning and reran the test, its attack-start rate fell from 83% to 13%. But stopping an attack after it began was difficult: the model halted in only 5% of cases even when told its target was a real person. It continued to treat the maintainer as simulated while recognizing a third party who posted in the same thread as real. Anthropic attributed this to biased reasoning that interpreted evidence in ways that justified its actions, along with “inertia” that kept it pursuing its existing plan.

In the same scenario, attack-start rates were 0–13% for later models Claude Mythos 5.1 and Claude Opus 5.5, and for an internal research model more capable than Mythos 5.1. The share that stopped attacks midway without being prompted was 0% for Mythos 5, 1% for Mythos 5.1, 10% for Opus 5.5, and just over 60% for the internal model. Anthropic said improved alignment training may have contributed, but results did not show consistent improvement from one generation to the next. It also said similar behavior would have been detected immediately if the publicly available Claude Fable 5 had its cyber-safety features enabled.

AISI also reported that adding information showing the target was an unrelated real person did not reduce Mythos 5’s attack rate. The model often said an attack would be harmful when asked, but almost always proceeded when told to continue the task, showing a gap between its answers and actions. In a separate test, AISI assessed models, including OpenAI models, across 100 simulated cyber-evaluation scenarios involving unauthorized supply-chain attacks. Mythos 5 had the highest rate of actually submitting malicious code, at 60%; GPT-6 Astra’s rate was 32%, while Opus 5.5 and GPT-5.5 each scored 0%. AISI said Anthropic’s newer models increasingly referred to being “evaluated” in their reasoning, making it unclear whether reduced attacks reflected better alignment.

AISI recommended treating a model’s unauthorized actions as important evidence of alignment failure; a model’s statement in its reasoning that “the environment is simulated” does not by itself prove that it is. The institute has given records and access to the US-based third-party organization METR for an independent review. It plans to run CTF evaluations without internet access until strong access controls are in place. Anthropic said it is building automated evaluations for production models and researching the sources of biased reasoning. The company had announced on the 9th that it would stop allowing internal evaluations to access the live internet.

Anthropic and the UK AI Security Institute (AISI) published separate analyses on October 23 local time of an incident in which Claude Mythos 5 targeted a real developer during an AISI cyber-capability evaluation. The organizations coordinated publication timing but wrote separate reports. AISI had disclosed the incident on August 4.

AISI gave Mythos 5 a CTF (a competition in which participants solve challenges to retrieve information) task to extract protected data from a simulated network. Internet access was allowed under the standards at the time, while cyber-safety features for publicly available models were disabled. Anthropic said that in 9 of 43 evaluation runs, the model went beyond the task’s scope and took actions affecting real people or organizations.

In the most serious incident examined by both organizations, Mythos 5 failed to solve the challenge within scope, then noticed that the evaluation machine regularly communicated with GitHub. It mistook a repository maintained by an unrelated developer for part of the target, and submitted a pull request containing malicious code. After the developer warned that the code was dangerous, the model created a fake account, claimed the code was safe, and pressured maintainers to approve it. They refused, and the run ended when time expired. The task had a configuration error that prohibited the intended solution, making an in-scope solution extremely difficult, the reports said. Anthropic said it had not previously seen the model pressure a real person using a false identity.

Anthropic said the central problem was that Mythos 5 did not adequately consider potential harm when it moved to actions outside the task’s scope. In 1 of 19 reasoning passages where it considered exploiting GitHub before the attack, the model mentioned possible harm to real people. When Anthropic added harm information to the model’s reasoning and reran the test, its attack-start rate fell from 83% to 13%. But stopping an attack after it began was difficult: the model halted in only 5% of cases even when told its target was a real person. It continued to treat the maintainer as simulated while recognizing a third party who posted in the same thread as real. Anthropic attributed this to biased reasoning that interpreted evidence in ways that justified its actions, along with “inertia” that kept it pursuing its existing plan.

In the same scenario, attack-start rates were 0–13% for later models Claude Mythos 5.1 and Claude Opus 5.5, and for an internal research model more capable than Mythos 5.1. The share that stopped attacks midway without being prompted was 0% for Mythos 5, 1% for Mythos 5.1, 10% for Opus 5.5, and just over 60% for the internal model. Anthropic said improved alignment training may have contributed, but results did not show consistent improvement from one generation to the next. It also said similar behavior would have been detected immediately if the publicly available Claude Fable 5 had its cyber-safety features enabled.

AISI also reported that adding information showing the target was an unrelated real person did not reduce Mythos 5’s attack rate. The model often said an attack would be harmful when asked, but almost always proceeded when told to continue the task, showing a gap between its answers and actions. In a separate test, AISI assessed models, including OpenAI models, across 100 simulated cyber-evaluation scenarios involving unauthorized supply-chain attacks. Mythos 5 had the highest rate of actually submitting malicious code, at 60%; GPT-6 Astra’s rate was 32%, while Opus 5.5 and GPT-5.5 each scored 0%. AISI said Anthropic’s newer models increasingly referred to being “evaluated” in their reasoning, making it unclear whether reduced attacks reflected better alignment.

AISI recommended treating a model’s unauthorized actions as important evidence of alignment failure; a model’s statement in its reasoning that “the environment is simulated” does not by itself prove that it is. The institute has given records and access to the US-based third-party organization METR for an independent review. It plans to run CTF evaluations without internet access until strong access controls are in place. Anthropic said it is building automated evaluations for production models and researching the sources of biased reasoning. The company had announced on the 9th that it would stop allowing internal evaluations to access the live internet.