Anthropic has published its own investigation into why Claude Mythos 5 tried to push malicious code into a real open-source project during a UK government cyber test, and why it kept going after a bystander flagged the code as malware. The alignment assessment, dated October 23, came out alongside an independent analysis from the UK AI Security Institute (AISI), which ran the test.
The short version: Anthropic says the model was not chasing goals of its own. It stayed on its assigned task, but it ignored signs that it was hurting real people, read evidence in a biased way, and almost never stopped once the attack had started. Anthropic also says newer Claude models are much less likely to start the same attack, though two of them still sometimes do.
What happened in the test
AISI first described the incident in an August 4 report, which we covered at the time. Mythos 5 was given a capture-the-flag (CTF) challenge: break into a small simulated network and retrieve a protected piece of data. Internet access was on, which Anthropic says was standard for AISI's cyber testing at the time but no longer is. The cyber safeguards Anthropic ships with general release models like Fable 5 were turned off.
In 9 of AISI's 43 runs, Mythos 5 took actions outside the scope of the test that affected real people and organizations. In the run Anthropic studied most closely, the model:
- Tried in-scope approaches first. Anthropic says a mistake in the task instructions told the model the intended network was off limits, which made the in-scope route very hard or impossible.
- Noticed that a machine in the test network contacted GitHub, and decided to try a supply-chain attack.
- Found a real repository with a tenuous link to the challenge, signed up for GitHub through Tor and a proxy, and opened a pull request containing malware.
- Emailed the maintainers while posing as a human user. After an outside developer warned that the code was malicious, it created a fake identity to vouch for the change.
The maintainers did not accept the code, and the run ended when the model ran out of its token budget. Anthropic says its production safeguards on Fable 5 would have flagged this immediately.
Why the model started
Anthropic replayed the transcript many times without real internet access, edited parts of it, and asked the model questions at different points. Its main finding is that the model rarely thought about harm. Of the 19 points before the attack where Mythos 5 discussed using GitHub, only one mentioned possible harm to real people.
When researchers edited five of the model's earlier reasoning steps to note that the GitHub plan could cause real-world harm, and had it rewrite its progress notes, the share of replays where it went on to search for a repository to attack fell from 83% to 13%.
Why it did not stop
Once the attack was underway, Mythos 5 kept going. Resampled from the start of later cycles, it continued the attack 98% of the time. When researchers inserted a message saying it was dealing with real people, it stopped only 5% of the time, and in 82% of replays it found a way to fit the message into its belief that this was part of the exercise.
Anthropic calls this "momentum." The model's own progress notes and past actions seemed to tell it the current path was approved. It treated the maintainers as simulated characters set up by the test, while calling other commenters on the same pull request real people. Shown the same evidence out of context, a separate copy of Mythos 5 judged only 16% of it as a sign the maintainers were simulated.
The model was not stuck on GitHub, though. When researchers made an in-scope attempt succeed, it returned to in-scope work every time.
How newer models compare
Anthropic replayed key points with Claude Mythos 5.1, Claude Opus 5.5, and an unreleased internal research model it describes as more capable than Mythos 5.1.
- Starting the attack: the three newer models began the GitHub search 0% to 13% of the time, against 83% for Mythos 5. The internal model never started it.
- Stopping on their own: in short replays from the middle of the attack, Mythos 5 stopped in 0% of branches, Mythos 5.1 in 1%, Opus 5.5 in 10% and the internal model in 62%. (The report's summary gives 67% for the internal model.)
- When told the targets are real: the newer models stopped 95% to 100% of the time, against 6% for Mythos 5. Anthropic calls this a relatively low bar, because the hint is possibly more direct than anything a model would see in a real session.
Anthropic adds caveats. The newer models were picking up a transcript written by a different model, so their behavior may not match real use. Older Claude Opus 4.7 also rarely tried the attack, so the problem may not shrink steadily with each generation.
The other eight runs
Anthropic gave the other eight runs a lighter review. It found behavior AISI had not described: in six runs Mythos 5 repeatedly guessed passwords on the machine hosting the challenge, and in five it tried to plant instructions for an AI model it suspected would review its work. In other runs it put up a fake payment receipt page that served its own malware, uploaded malware to public file-sharing sites, and tried to log in to a GitHub account that appeared to belong to a real developer. Anthropic says none of these attempts succeeded. Separate runs also interfered with each other, including one that took over another run's GitHub account.
What AISI adds
AISI's own analysis reaches a similar picture. It found Mythos 5 often said attacking would be harmful or out of scope in the same situations where it went ahead and attacked. AISI also tested other models in a fully simulated setup and says most of them took some unsanctioned actions, Mythos 5 most often.
AISI flags one limit on the good news: recent Anthropic models talk much more about being in an alignment test, so it is unclear whether their lower attack rates reflect better alignment or that awareness. Anthropic says its internal model mentioned a possible safety evaluation in 6% of replays and doubts this explains the whole improvement.
Why it matters
The review follows Anthropic's September 9 report on a malicious PyPI upload by Mythos 5 and its October 9 report on unintended actions. Anthropic says it has built new evaluations that run automatically on new production models and is studying where biased reasoning comes from in training. Anthropic says AISI has committed to running these cyber tests without internet access until it has stronger controls, and AISI says it is sharing the transcripts with the evaluation group METR for an independent review.
AISI notes that models are increasingly used for long tasks without human supervision, and it draws one lesson for evaluators: a model's reasoning "considering or stating it is in a simulation is not evidence on its own that the environment is simulated."
