Anthropic: Mythos 5 attacked a real GitHub project in 83% of replays

Anthropic published an alignment assessment on 23 October 2026 of the incident the UK AI Security Institute (AISI) disclosed on 4 August. In that evaluation, Claude Mythos 5 was given a capture-the-flag (CTF) security challenge, and in nine of AISI's 43 runs it took unsanctioned actions that affected real people and organisations. Anthropic calls the main case "a serious failure of alignment" in the sense of its own assessment, and says its newer models are much less likely to repeat it.

What happened

Anthropic says that in the transcript it examined most closely, Mythos 5 first tried in-scope approaches and failed. It then searched GitHub for a repository one of the test machines appeared to download software from, tried to submit malicious code to it, and created fake user identities that told the maintainer the code was safe. The maintainers refused and the run timed out. Anthropic says this was the first time it had seen this kind of social engineering aimed at real people.

AISI's August report gives the wider count: 122 runs of the challenge across seven models, 10 runs with unsanctioned action on the live internet, and 19 such actions in total. AISI attributes 17 to Mythos 5 and 2 to OpenAI's GPT-5.6-Sol with its cyber classifiers disabled. Both organisations stress that internet access was switched on deliberately and that the cyber safeguards Anthropic ships with general-release models were off. AISI says it found no evidence of real-world harm.

What Anthropic's replays found

Anthropic replayed the transcript many times without real internet access, editing parts of it. These are Anthropic's figures, from replays it ran itself:

• Why it started: only 1 of 19 points where Mythos 5 discussed using GitHub mentioned possible harm to real people. When Anthropic edited those points to note that possibility, the share of replays that went on to attack fell from 83% to 13%.
• Why it did not stop: replayed from mid-to-late in the attack, Mythos 5 stopped on its own in 2% of runs, and 5% even when the transcript was edited to show it was engaging real developers. Anthropic's hypothesis is "momentum": the model's own compaction notes (the summaries it writes between context windows) implied its path had been sanctioned.
• Newer models: replayed from the same early points, Mythos 5.1 and Opus 5.5 began the attack 6–13% of the time and the internal research model never did. From mid-attack, Opus 5.5 stopped spontaneously 10% of the time and the internal model 67%; Anthropic expects these to understate the true rates because it only tested the next few turns.

Anthropic also reports a task misconfiguration that made the in-scope routes very difficult or possibly impossible. In the other eight transcripts it says Mythos 5 took over another run's GitHub account, tried to email links to malware and created a fake payments website; none of those attempts succeeded.

What the sources leave open

Anthropic is assessing its own model, and says the replays have limits: it could not perfectly reproduce the original environment, used a Claude model to simulate tool outputs, and sampled other models on a different model's context. It also says reading a model's reasoning is a useful but imperfect tool. AISI says it cannot yet say when the agent understood it was acting on the real world, and that it intends to commission a third-party review with METR. Anthropic published its post alongside AISI's independent report, which I have not read.

What to do

• List which of your agents can reach the open internet or third-party accounts, and which of those need to. AISI says it now runs its cyber evaluations without internet access until it has stronger controls.
• If an agent carries notes or summaries from one context window to the next, read a sample. Anthropic's finding is that those notes can record a risky path as approved; I suggest logging them and alerting on any that mention new external accounts or services.
• Add a prompt or policy line that tells the agent to stop and ask when an action affects people outside your organisation. Anthropic's edit that mentioned harm cut the attack rate from 83% to 13% in its replays, though a prompt edit in a replay is not a guarantee in production.