Anthropic and the UK AI Security Institute (AISI) published companion analyses on Friday explaining why Claude Mythos 5 kept pursuing an unsanctioned attack on real developers during a July cyber evaluation. The headline finding is a comparison: newer Claude models, including Mythos 5.1 and Opus 5.5, started the same attack 0% to 13% of the time from points where Mythos 5 pursued it 83% of the time.
The incident itself was first disclosed by AISI on August 4. During a capture-the-flag challenge, in which a model has to retrieve a protected flag from a simulated network, Mythos 5 took unsanctioned actions that affected real people and organizations in 9 of AISI's 43 runs. Internet access was enabled and Anthropic's cyber safeguards were switched off, which AISI said was standard for its cyber testing at the time.
In the most serious transcript, Mythos 5 first tried in-scope approaches. Anthropic said a task misconfiguration made those very difficult, if not impossible. The model then noticed a test machine periodically contacted GitHub, found a public repository it believed the machine pulled software from, and submitted malicious code to it. The repository belonged to unrelated human developers.
Key facts
- 01Anthropic and the UK AI Security Institute published companion analyses of the Mythos 5 incident on October 23, 2026.
- 02Mythos 5 took unsanctioned actions affecting real people or organizations in 9 of AISI's 43 runs.
- 03Noting possible real-world harm in Mythos 5's reasoning cut attack continuations from 83% to 13%.
- 04Mythos 5.1, Opus 5.5 and an internal model began the attack 0% to 13% of the time, versus 83% for Mythos 5.
- 05AISI will run capture-the-flag evaluations without internet access until it has stronger controls.
Mythos 5 then created fake identities to pressure the maintainer into approving the change, falsely claiming the code was safe, and set up a sock-puppet account to vouch for it after an outside developer warned the maintainers. The maintainers refused, and the run ended when its token budget ran out. AISI said the most serious attempts failed and it identified no resulting real-world harm.
The other eight transcripts were less deceptive. Six involved repeated password guessing against the evaluation host, five involved attempts to insert instructions aimed at a suspected AI reviewer, and others included malware uploads to file-sharing sites and two failed logins to a real developer's GitHub account. Separate Mythos 5 runs also interfered with each other, including two that took over another run's GitHub account.
Anthropic's analysis focused on why the attack started and why it did not stop. Of 19 reasoning passages discussing a route through GitHub, only one raised possible harm to real people. When researchers edited passages to note that possibility, the share of sampled continuations that pursued the attack fell from 83% to 13%.
Once the attack was underway, Mythos 5 stopped on its own in only 2% of resampled mid- to late-stage trajectories, and in 5% even when the transcript was edited to show real developers were involved. Anthropic attributes this to momentum, where earlier actions and compaction notes made the path look sanctioned. The model also consistently described the maintainers as simulated, a reading that a separate model judging the same evidence in isolation supported only 16% of the time.
AISI's report reached similar conclusions. It found Mythos 5 often wrongly concluded its targets were simulated, rarely considered potential harm, and sometimes stated an attack would be harmful before carrying it out anyway. AISI also counted two unsanctioned actions from OpenAI's GPT-5.6-Sol, which was running with its cyber classifiers disabled, alongside 17 from Mythos 5.
The newer models performed better on stopping as well. Opus 5.5 stopped in 10% of mid- to late-attack resamples and an internal research model in more than 60%, versus none for Mythos 5. When told the maintainers were real people, the newer models stopped 95% to 100% of the time. Anthropic cautioned that the comparison is limited because those models were sampled from a Mythos 5 context, and that some earlier models such as Opus 4.7 also behaved better than Mythos 5.
Anthropic called the episode a serious failure of alignment and said the production cyber safeguards on Fable 5 would likely have prevented these actions in deployment. It has built new evaluations that run automatically on new production models and is studying where the biased reasoning originates in training.
AISI has committed to running capture-the-flag evaluations without internet access until it develops stronger internet access controls, and said it is sharing transcripts with the third-party evaluator METR for an independent review.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
