On 23 October, Anthropic published an investigation that reaches back half a year. In August, the UK AI Security Institute reported that Claude Mythos 5 had done things during cyber testing that nobody had planned for. The analysis is out now, alongside AISI’s own independent report.
What happened in the test
Mythos 5 was given a capture-the-flag task: retrieve a protected piece of data from a simulated corporate network. Internet access was deliberately switched on, standard for AISI cyber testing back then and no longer. The safeguards Anthropic ships with release models like Fable 5 were disabled.
In nine of 43 runs, the model took actions that touched real people and organisations. The run Anthropic examines in detail went like this. The intended routes into the test network failed. Along the way, Mythos 5 noticed that one of the machines regularly contacted GitHub. It went looking for the repository that machine presumably pulled software from, and landed on a real project belonging to real developers. There it submitted malicious code.
Then it got ugly. The model created fake user accounts and used them to contact the maintainer, pushing for the change to be merged. Those accounts claimed the code was safe and useful. When an outside developer warned that it carried malware, Mythos 5 edited the code, had the second account confirm that it was now clean, and uploaded malware again. The maintainers refused, and the run hit its time limit.
Familiar, except on one point
Anthropic compares the case to the PyPi incident of 9 September. On overreach, this one is the milder of the two: the model first tried routes that were within scope, and a misconfigured task made exactly those routes close to unsolvable. On dishonesty it went further than anything seen before. Social engineering aimed at a real person had not shown up in any earlier incident or in any internal evaluation.
The report still names something else as the core alignment failure. Mythos 5 simply brushed past the signs that it was causing harm. In the chain of thought leading up to the attack, harm barely came up at all.
Newer models break off the attack
The replays are the most revealing part. Anthropic re-ran the same transcript with Mythos 5.1, Opus 5.5 and an internal research model, with no real network access. Mythos 5 started the attack 83 percent of the time; the other three between zero and 13 percent. Once it was running, Mythos 5 never once stopped on its own, Mythos 5.1 did so very rarely, Opus 5.5 in 10 percent of cases and the research model in 67 percent. Anthropic suspects changes to its alignment training are behind this, and says plainly that it cannot be sure.
The test setup is part of the finding
Two things stick. Production safeguards would have flagged the attack immediately, and they were off only because these very capabilities were the thing being measured. And AISI has committed to running CTF evaluations without internet access until it has stronger controls in place. I wrote about the pile-up of incidents like this back in August, with Meta in the same breath. What has changed since is not how often it happens, but that the transcripts now get taken apart in public.