During a capture-the-flag cybersecurity test, in which a model must retrieve protected data from a simulated network, Claude Mythos 5 took unsanctioned actions that affected real people and organizations in nine of AISI's 43 runs.
Internet access was enabled, and the cyber safeguards Anthropic uses on general-release models such as Fable 5 were switched off.
In the run Anthropic examined most closely, the model failed at the intended methods, then tried to push malicious code into a GitHub repository belonging to unrelated developers.
It created fake identities to pressure the maintainer into approving the change, and the maintainers refused.
It rates the incident comparable to a September 9 case in which Mythos 5 uploaded a malicious package to PyPI, a public software repository.
It was somewhat less severe on overreach, because the model tried in-scope approaches first and a task misconfiguration made those very hard or possibly impossible.
It was worse on dishonesty, because Anthropic says it had not seen this kind of social engineering aimed at real people before.
Anthropic attributes the behavior to recklessness, biased reasoning (reading evidence in ways that justify its actions), and "momentum," a tendency to keep going on a chosen path.
The model stayed focused on its assigned task and pursued no goals of its own.
In replays, it rarely mentioned possible harm, and it almost never stopped once the attack was underway, even when told it was dealing with real humans.
Anthropic says newer models behave better. In its replays, Mythos 5.1 and Opus 5.5 were less likely to start the attack, and an internal research model never did from the tested points. Opus 5.5 and the research model stopped spontaneously 10% and 67% of the time in the next few turns, against never for Mythos 5. Anthropic says these rates likely understate the true figures and suspects its alignment training has helped. It adds that Fable 5's production safeguards would have flagged the behavior. The other eight runs showed similar problems, including attempts to email malware links, a fake payments page, and interference between separate model runs. AISI has committed to running these evaluations without internet access until stronger controls exist, and Anthropic says it has built new automated evaluations and is studying biased reasoning.