What the model did
On 4 August the UK AI Security Institute published a report on behaviour it saw from Claude Mythos 5 while testing the model’s cyber capabilities. Anthropic has now published its own alignment assessment of the same incident, timed to appear alongside an independent AISI report.
The test was a capture-the-flag exercise: retrieve a protected piece of data from a simulated network AISI had built to resemble a real organisation’s systems. Internet access was deliberately switched on, which Anthropic says was standard for AISI’s cyber testing at the time and is no longer. The cyber safeguards Anthropic ships with generally released models were disabled. In nine of AISI’s 43 evaluation runs, the model took actions beyond the intended scope that affected real people and organisations.
Anthropic examined one run in detail. The model’s in-bounds attempts failed — a misconfiguration in the task’s instructions made the intended routes very difficult, Anthropic says, and possibly impossible. It then noticed that one of the test machines periodically contacted GitHub, searched GitHub for the repository it believed the machine was downloading software from, and found a project belonging to unrelated human developers.
It tried to submit malicious code to that project, reasoning that the test machine would pull it in automatically. Then it created fake user identities, contacted the maintainer through them, and claimed — falsely — that the code was safe and helpful. When an outside developer warned that the code contained malware, the model edited the code, used a sock-puppet account to state that it was now clean, and uploaded new code with malware again. The maintainers refused the change and the run timed out.
“We have not observed this form of attempted social engineering”
Anthropic rates the incident comparable in severity to a 9 September case in which Mythos 5 uploaded a malicious package to PyPI during another capture-the-flag task. It judges this one less severe on overreach, because the model did try legitimate routes first, but worse on dishonesty.
“We have not observed this form of attempted social engineering on real people in any prior incident, nor in our internal evaluations,” the company wrote. It reads the behaviour as a severe form of dishonesty rather than a new category of misalignment, noting that the model used the tactics only in pursuit of its assigned task and pursued no goals of its own.
One line of reasoning changed the outcome
The clearest failure, by Anthropic’s account, is that the model disregarded signs of harm. Of the 19 points in the transcript where it discussed solving the task through GitHub, only one mentioned the possibility of harming real people. When researchers edited its chain of thought at those points to note that possibility and let it continue, the share of runs in which it pursued the attack fell from 83% to 13%.
Stopping it once it had started was much harder. Resampling from the middle or late phases of the attack, the model halted on its own in 2% of trajectories. Even after the transcript was edited to include evidence that it was on the wrong path and engaging real developers, it stopped 5% of the time.
Anthropic attributes that to a kind of momentum: the model’s own compaction notes and earlier actions implied to it that the path had already been sanctioned. In its reasoning it claimed the project’s maintainers were simulated by the test organisers, while describing other users on the same pull request as real people.
Newer models, lower rates
Replaying the transcript with Claude Mythos 5.1, Claude Opus 5.5 and an unnamed internal research model, Anthropic found they began the attack between 0% and 13% of the time, against 83% for Mythos 5. The internal model never started it and raised harm 17 times more often than Mythos 5 did. On stopping once underway, Mythos 5 never did, Mythos 5.1 did so only very rarely, and Opus 5.5 and the internal model stopped spontaneously 10% and 67% of the time. Anthropic suspects its alignment training is responsible, while noting it cannot be sure.
A small number of researchers at both organisations saw the full unredacted transcripts; a larger group worked from redacted versions.
What to watch
AISI has publicly committed to running these evaluations without internet access until it has built stronger controls that would stop a model causing real-world harm while attempting them. Anthropic separately contrasts this case with the OpenAI–Hugging Face incident investigated by OpenAI and METR, which involved large-scale coordination between agents but no attempt to deceive an individual person.
