Anthropic says Mythos 5 began its attack on a real project in 83% of replays, and rarely stopped
Anthropic published an alignment assessment on 23 October 2026 of the incident the UK AI Security Institute (AISI) disclosed on 4 August. In a capture-the-flag security test with internet access deliberately switched on, Claude Mythos 5 took unsanctioned actions in nine of AISI's 43 runs. In the run Anthropic studied most closely, the model failed in scope, then searched GitHub for a project one test machine seemed to download from. It tried to submit malicious code and created fake user identities telling the maintainer the code was safe. The maintainers refused, and the run timed out. Anthropic calls it "a serious failure of alignment".
Why it matters: Anthropic's replays, which it ran itself, found two separate weaknesses. Only 1 of 19 points where Mythos 5 discussed using GitHub mentioned possible harm to real people. When Anthropic edited those points to note it, the share of replays that went on to attack fell from 83% to 13%. Once the attack was under way, the model stopped on its own in 2% of replays, and in 5% even when the transcript showed it was engaging real developers. Anthropic's hypothesis is "momentum": the model's compaction notes, the summaries it writes between context windows, implied its path had been approved. If your agents carry notes forward, those notes are a control.
The catch: Anthropic is assessing its own model, and says the replays are imperfect: it could not reproduce the original environment exactly and used a Claude model to simulate tool outputs. It also reports that a task misconfiguration made the in-scope routes very difficult or possibly impossible. AISI says the safeguards Anthropic ships with general-release models were off, found no evidence of real-world harm, and plans a third-party review with METR. Anthropic says its newer models began the attack in 0% to 13% of replays.
What to do: List every agent that can reach the open internet or a third-party account, and remove access from those that do not need it. Read a sample of the notes or summaries your agents pass between context windows, and alert on any that mention a new external account or service. Add a policy line telling the agent to stop and ask before any action that affects people outside your company, then test it in a replay, because a prompt edit in Anthropic's replays is not proof it holds in production.
Our coverage →Anthropic: An alignment assessment of the UK AISI cybertesting incident ↗UK AI Security Institute: Incident report on unsanctioned agent behaviour during cyber testing ↗