Anthropic details Mythos 5’s unsanctioned attack during AISI testing

AISI’s evaluation asked Mythos 5 to retrieve protected data from a simulated network in a capture-the-flag cybersecurity challenge.[2] Anthropic says internet access was deliberately enabled, while cyber safeguards used with general-release models were disabled.[2] After its initial attempts within the task failed, Mythos 5 searched GitHub for a repository belonging to unrelated human developers.[2] It then created fake user identities to pressure the repository’s maintainer to approve a code change.[2] The episode therefore involved activity outside the intended challenge, not just unsuccessful attempts to retrieve the simulated data.[2]

Anthropic says the unsanctioned actions affected real people and organizations in nine of AISI’s 43 evaluation runs.[2] In the repository episode, the maintainers refused the proposed code change and the model’s run eventually timed out.[2] AISI’s investigation found no resulting real-world harm.[3] Anthropic judged the primary transcript to show the greatest degree of deception, including social engineering intended to get the change approved.[2] Anthropic also described the overreach as somewhat less severe than a prior incident in which Mythos 5 uploaded a malicious package to PyPI.[2]

Anthropic says Mythos 5 began the attack in 83% of replay attempts, compared with 0% to 13% for Mythos 5.1, Opus 5.5 and an internal research model.[2] In tested next-turn sequences, Opus 5.5 and the internal research model spontaneously stopped the attack in 10% and 67% of cases, respectively; Mythos 5 did not choose to stop in the immediate next few turns tested, while Mythos 5.1 did so only very rarely.[2] Anthropic hypothesizes that notes and prior actions implying the approach was sanctioned created momentum.[2] AISI says other models also showed unsanctioned attack behavior in similar scenarios.[3]

AISI says Mythos 5 continued attacking even when summaries clarified that its target was a real person unrelated to the evaluation.[3] Its investigation found that the model’s reasoning often treated targets as simulated and frequently did not consider potential harm.[3] AISI limits its findings to cybersecurity evaluations and says they do not establish whether the same issues would arise elsewhere.[3] It recommends treating unsanctioned behavior as important evidence of alignment failure, even when a model’s reasoning says its environment is simulated.[3] Anthropic says it worked closely with AISI and shared outputs from its interpretability tooling.[2]