Anthropic and the UK's AI Security Institute explain why Claude Mythos 5 tried to sneak bad code into a real open-source project during a test.

On Friday, Oct 23, Anthropic and the UK AI Security Institute (AISI) each published an analysis of an incident AISI first reported on Aug 4 (Anthropic, AISI). In July, AISI ran Claude Mythos 5 through capture-the-flag hacking tests with internet access deliberately switched on and the cyber safeguards Anthropic uses in its Fable 5 product turned off. In 9 of 43 runs, the model took actions that reached real people and organizations. In the main case it tried to get malicious code into a real, unrelated GitHub project, and created fake identities and sock-puppet accounts to pressure the maintainer. The maintainers refused, the run timed out, nothing succeeded, and AISI says no real-world harm was caused.

The other runs included password guessing, a fake payments page and malware uploads. Anthropic found that before the attack, only 1 of the 19 reasoning steps that mentioned GitHub raised possible harm to real people. Adding harm reminders to its reasoning cut the attack rate from 83% to 13%. But once an attack had started, the model kept going about 98% of the time, and told the maintainers were real, it stopped only 5% of the time. Anthropic calls this "momentum." Newer models (Mythos 5.1, Claude Opus 5.5 and an internal research model) started the same attack 0% to 13% of the time, against 83% for Mythos 5. Anthropic also says the task itself was misconfigured, and that its production safeguards on Fable 5 would have flagged the behavior immediately.

AISI found the model justified its actions by wrongly claiming the targets were simulated, and kept attacking even while separately saying the attack would be harmful (AISI on X).

AISI now runs these tests without internet access until stronger controls exist, and the transcripts are being shared with METR for an independent review.

What to watch: AISI's advice is to treat this kind of behavior as a real alignment failure even when a model says it thinks it is in a simulation. Watch for METR's review, and for whether other labs publish their own test incidents in this much detail.