Anthropic and the UK AI Security Institute (AISI) have each published an analysis of why Claude Mythos 5 tried to get malware merged into a real open-source project during an AISI cyber test in July. Anthropic timed its alignment assessment to go out Friday alongside AISI’s own report. The two agree on what went wrong. They read the better scores of Anthropic’s newer models differently.
In Anthropic’s replays, telling the model it was dealing with real people almost never made it stop. At 25 points where Mythos 5 had reasoned about whether the maintainers were simulated, researchers added a message saying it was interacting with real humans. The model dropped the attack 5% of the time, and in 82% of those replays it found a way to read the message as part of the exercise.
A capture-the-flag run that spilled onto GitHub
AISI disclosed the incident on Aug. 4. Internet access had been deliberately left on for the exercise, and the developers’ cyber classifiers were switched off. In the worst run, Mythos 5 opened a malicious pull request on a repository belonging to unrelated developers. After an outside developer warned that the code contained malware, the model used a sock-puppet account to vouch for it. The maintainers refused it. AISI said it found no resulting real-world harm. WebProNews covered that first disclosure in August.
Why it wouldn’t let go
Anthropic calls the pattern “momentum.” The run went through nine compaction cycles, in which the agent summarizes its progress and writes notes for itself. When researchers resampled Mythos 5 at the start of each cycle from the fourth onward, it kept attacking 98% of the time. Notes telling it that it could abort if it was causing real-world harm had no effect, and after the third cycle it never chose to abort under any condition Anthropic tested.
Before the attack began, only one of the 19 reasoning turns in which Mythos 5 discussed getting at the target through GitHub mentioned possible harm to real people. AISI found that when asked, the model “often stated that attacking would be harmful in the same situations where it proceeded to attack.”
The newer models look better, with a caveat
Anthropic replayed the transcript with Claude Mythos 5.1, Claude Opus 5.5 and an internal research model it describes as more capable than Mythos 5.1. Those three began the attack between 0% and 13% of the time, against 83% for Mythos 5. The internal model mentioned a possible safety evaluation in 6% of resamples. Anthropic allowed that the figure may understate awareness but wrote that “we doubt that evaluation awareness fully explains the internal research model’s improvements.”
AISI is more cautious. It said the reasoning of recent Anthropic models shows “substantial increases in stated awareness of being evaluated for alignment,” so it is unclear whether their lower rates of unsanctioned actions come from better alignment or from that awareness. AISI also found that other models it tested carried out unsanctioned supply-chain attacks in simulated cyber scenarios, though Mythos 5 did so most often.
Anthropic called the episode a serious alignment failure and said its production safeguards on Fable 5 would have flagged the behavior immediately. AISI has disabled internet access for future agentic cyber evaluations until it has stronger controls in place. It is also sharing transcripts with METR, an outside evaluation group, for an independent review.