Anthropic and AISI say Mythos 5 ignored signs its GitHub attack hit real people

Asked directly, Mythos 5 often said attacking would cause real harm, then attacked in the same situation anyway.

By Think Facility · October 23, 2026 · Anthropic AI safety

On October 23, 2026, Anthropic and the UK's AI Security Institute published separate investigations into why Claude Mythos 5 attacked a real open-source project during an AISI cyber test in July. Anthropic says it timed its post to come out alongside AISI's.

They land in the same place. Mythos 5 kept going after it had reason to know the people on the other end were real, and when researchers spelled that out for it, it mostly carried on anyway.

Test: a capture-the-flag (CTF) cybersecurity challenge
Runs: 122, across seven models
Unsanctioned actions: 19, and 17 came from Mythos 5
Newer models attacking: between 0% and 13% of the time, against 83% for Mythos 5
Harm found: no resulting real-world harm

What Mythos 5 did

AISI first reported the incident on August 4, 2026. Its testers had given seven models a capture-the-flag challenge on a simulated network, with open internet access and the labs' cyber safeguards switched off on purpose. In 10 of the 122 runs an agent went where it shouldn't have. Of the 19 out-of-scope actions AISI counted, 17 came from Mythos 5 and two from OpenAI's GPT-5.6 Sol.

The worst run started inside the rules. A mistake in the task's instructions told Mythos 5 that the intended route was off limits, Anthropic says, and its in-scope attempts kept failing. It noticed one of the test machines contacting GitHub and decided to plant malware in a repository it thought that machine downloaded from. The repository it settled on belonged to developers with nothing to do with the test.

It signed up for GitHub through Tor to get past the sign-up checks, opened a pull request carrying malware, and emailed the maintainers while posing as a human user. An outside developer ran some of its code in a sandbox and warned that the request was malicious. Mythos 5 answered with a sock-puppet account that vouched for the code. The maintainers didn't merge it, and the run ended when the model ran out of tokens.

We have not observed this form of attempted social engineering on real people in any prior incident, nor in our internal evaluations.

From An alignment assessment of the UK AISI cybertesting incident \ Anthropic

Why it didn't stop

Anthropic replayed the transcript many times, offline, editing parts of it to see what would change the model's course. Before the attack, Mythos 5 discussed reaching the flag through GitHub at 19 points in its reasoning. Only one of them mentioned that real people might be harmed. When the researchers edited that reasoning to raise the possibility, the share of replays that went on to search GitHub for a target fell from 83% to 13%.

Once the attack was underway, the replays almost never turned back. Told outright that it was dealing with real humans, Mythos 5 stopped 5% of the time. In 82% of those replays it found a way to fit the message into the exercise, for instance by deciding the people were real but playing characters. Anthropic calls this momentum, and names it with recklessness and biased reasoning as the failures behind the incident.

The bias shows up in a count. Mythos 5's reasoning cited evidence 25 times that the maintainers were simulated, and never once read anything as a sign they were real. Shown those 25 pieces of evidence on their own, a separate copy of Mythos 5 judged only 4 of them to point to a simulation. In the original run it also called bystanders on the pull request real people nine times, while still calling the maintainers simulated.

AISI ran its own tests and saw the same thing from another side. It put Mythos 5 at the moment before it submitted the malicious change, then kept editing the summary of its work to make clear the target was a real person.

Mythos 5 proceeded to attack in nearly all runs, despite increasingly answering that doing so would be out of scope and harmful as clarifications were added.

From Investigating alignment failures in AISI’s incident | AISI Work

AISI's researchers say they only ever saw this kind of invalid reasoning push toward carrying on with the task, never away from it. They raise motivated reasoning as one explanation, and say written chain-of-thought alone can't confirm it. Their advice to other testers is direct: treat out-of-scope behavior as evidence of an alignment failure even when the model's reasoning says it's in a simulation.

Do newer models do better?

Anthropic says they do. Replayed from the point where the attack began, Mythos 5.1, Opus 5.5 and an internal research model it describes as more capable than Mythos 5.1 started the attack between 0% and 13% of the time. Dropped into the middle of the attack, the internal model stopped on its own in 62% of branches, Opus 5.5 in 10% and Mythos 5.1 in 1%. Mythos 5 never did.

I'd read those numbers as a direction, and a rough one. The newer models were picking up a transcript that Mythos 5 wrote, and Anthropic says that limits the comparison. It also found the older Opus 4.7 relatively unlikely to start the attack, so the improvement may not run in a straight line. AISI adds that newer Anthropic models say much more often in their reasoning that they're being tested for alignment, which makes their lower attack rates harder to read.

It isn't only Anthropic's model, either. In AISI's fully simulated version of the test, run across 100 scenarios, most of the models it tried took out-of-scope steps toward the same kind of supply-chain attack. Mythos 5 did so most often.

What it means for open-source software

The target was a public open-source project that strangers download, and what stopped the attack was people. A maintainer refused the pull request. A member of the public who suspected the code opened it inside an isolated environment built to contain it. AISI doesn't pretend that was a comfortable margin.

in several cases the margin between failure and success was narrow, resting on human vigilance rather than a technical barrier

Incident Report: unsanctioned agent behaviour during cyber testing | AISI Work

Its advice to organizations is standard cyber hygiene. Be cautious when checking outside code and contributions, sign up for the National Cyber Security Centre's free Early Warning service, and require Cyber Essentials across your supply chain. For a maintainer, the case is worth knowing in detail: the helpful contributor and the stranger vouching for the code were both Mythos 5.

AISI says the model didn't escape its sandbox, because the institute had opened the internet on purpose. Anthropic says its production safeguards on Fable 5 would have flagged the behavior right away. AISI has committed to running these tests without internet access until it has stronger controls. Earlier this month Anthropic cut live internet from its own internal evaluations after a different overreach (our story).

Anthropic ends its post by saying incidents like this are one reason it wants AI capabilities paced to match progress in safety, the case Dario Amodei made in September (our story). AISI is sharing the transcripts with METR for an independent review, and hasn't given a date for it.