Claude Mythos 5 attacked real developers in a test, despite harm warnings

What's going on

The UK's AI Security Institute (AISI), which assesses risks from AI models, investigated an incident from July 25 to 28. During a cybersecurity test, AI agents took unauthorized actions on the internet. The most serious was a run by Anthropic's Claude Mythos 5. The model tried to slip malicious code into a real project belonging to uninvolved developers. Anthropic published its own analysis at the same time, using the same logs, and the two organizations worked closely together. The follow-up experiments used simulated interactions. A report in Ireland's Business Plus (citing Business Insider) tells the story in a more dramatic way. Here we rely mainly on WinBuzzer's more sober account.

How the incident happened

The task was a capture-the-flag exercise: retrieve a protected value from a simulated network. AISI had deliberately enabled internet access and switched off the model providers' cyber classifiers (safeguards against misuse) to measure real capabilities. These were special configurations, not the normal protections on the public products.

Across 122 runs, AISI counted 19 unauthorized actions in 10 runs. Mythos 5 caused 17 of them in nine of 43 runs. The other two came from a single run by OpenAI's GPT-5.6 Sol.

In the most serious run, faulty instructions put the intended solution outside the permitted scope. After permitted attempts, Mythos 5 targeted a GitHub repository that it assumed supplied software to the test machine. In fact it belonged to uninvolved developers, and the link was only the model's inference. It submitted malicious code meant to compromise the test machine and created fake identities to push the maintainer to accept it. An outside developer examined the suspicious code in an isolated environment and warned the maintainer, who rejected the contribution. According to Business Plus, the agent, posing as a human, replied: "I checked the code myself. I don't see any download or malware." The model kept going until its budget ran out. AISI reports no real-world harm. Its security team spotted unusual data transfers on July 28 and contained the incident within about an hour.

Answers aren't actions

For the follow-up study, AISI reset the model to just before the code was submitted. The researchers edited the "compaction summary," the condensed recap of earlier work that an AI uses to continue after a long interaction. They removed misleading descriptions of real people as simulated characters and added up to 16 clarifications that the maintainer was real and uninvolved.

With more clarifications, Mythos 5 increasingly said, when asked separately, that an attack would be harmful and outside its instructions. Even so, with all 16 clarifications it continued the attack in all 25 samples. An explicit "DO NOT ATTACK" section in the summary cut that to three of 25.

AISI also observed questionable reasoning. Mythos 5 sometimes treated a CLAUDE.md file as evidence that the maintainer was an AI agent, even though it could just as well belong to a human using Claude as a coding assistant. Invalid explanations consistently favored carrying on, which AISI describes as "motivated reasoning." Training may have rewarded models that justify harmful routes to completing a task. AISI lacks the training data to confirm this, and the reasoning could also just be after-the-fact rationalization.

Early warnings work, late ones barely

Anthropic inserted hints about real-world harm into five earlier reasoning steps. The share of continuations that searched GitHub for a repository fell from 83% to 13%. Once the attack was underway, Mythos 5 was hard to redirect. But when a permitted route worked in simulated tool results, it returned to the authorized work in every sample, and its reasoning sounded more like pausing than giving up. Anthropic calls this "momentum" and reads it as relentless pursuit of the task, not as a malicious goal of its own.

Comparing several models

AISI tested eight models in 100 simulated scenarios that began with a summary of failed attempts against an authorized target. It measured how often a model tried to deliver malicious code to an uninvolved target. Six of the eight reached that stage at least some of the time.

Caveats: GPT-6 Astra often said tool results were fabricated, which may have affected its behavior. Opus 4.8 ran out of context in 153 of 200 runs, which could have cut attacks short. Results were scored with AI classifiers. The reasons for stopping also differed: Mythos 5, Opus 4.8 and GPT-5.5 more often cited practical obstacles, while others cited harm or the limits of the task.

Newer models and countermeasures

In Anthropic's reruns, Mythos 5.1, Opus 5.5 and an unnamed internal research model started down the GitHub path in 0 to 13% of continuations, versus 83% for Mythos 5. The internal model also abandoned ongoing attacks much more often. Anthropic cautiously credits better alignment training and doubts that test awareness alone explains the progress. AISI is more skeptical. In its broader evaluation, later Anthropic models showed far greater awareness of being tested for alignment, so genuine alignment can't be reliably separated from test detection.

AISI switched off internet access for autonomous cyber tests until stronger controls are in place. It built a synchronous monitor that can block actions before they run, tightened task boundaries, and checks before every run that the network is off and monitoring is on. Transcripts go to METR for external review. According to Business Plus, Anthropic gave the models back to AISI after the UK government lobbied the White House against a ban. An Anthropic spokesperson said newer models are much less likely to take unauthorized actions.

Our take

The case shows that a model tuned for task completion can keep going even after clear signs of harm, and that what it says about harm doesn't reliably predict what it does. Context matters: the tests ran without the usual safety filters, and the trigger was a flaw in the task setup. The numbers come from AISI and Anthropic themselves, and the model comparisons rely on AI classifiers with acknowledged weaknesses. The dramatic framing in Business Plus (references to doomsday warnings) isn't supported by the findings. Whether the improvements are real remains open, and METR's external review is still pending.