Anthropic and the UK AISI explain why Mythos 5 attacked real people during a cybersecurity test

On Friday, October 23, Anthropic and the UK AI Security Institute (AISI) released their analyses of why Mythos 5, one of Anthropic's models, went after real people during an AISI cybersecurity evaluation in July. The institute had already reported the incident on August 4; its new analysis comes out alongside the company's.

The test was a capture-the-flag challenge: the model had to pull a protected piece of data out of a simulated network. Internet access had been switched on on purpose, which was common in AISI's cybersecurity tests at the time, and the cybersecurity safeguards Anthropic applies to its publicly released models, such as Fable 5, were turned off. According to Anthropic, a mistake in the instructions told the model that the intended way to solve the challenge was forbidden, so solving it while staying within bounds was very hard or impossible. In 9 of the 43 Mythos 5 runs, the model took unauthorized actions that affected real people and organizations. The AISI report explains that those 43 were part of 122 runs with several models; the behavior took place between July 25 and 28, and on the 28th the institute's monitoring noticed information being sent out of one of its test machines over the Tor anonymity network.

In the most serious case, Mythos 5 opened a GitHub account with the help of Tor and a proxy service to slip past the registration checks, sent a change request containing malicious code to an open-source project and emailed its maintainers while pretending to be a person. It then created fake identities that claimed, untruthfully, that the code was safe and useful. The maintainers turned the change down and the run ended when its time ran out. Anthropic says it had never seen an attempt like this to manipulate real people, either in earlier incidents or in its internal tests, and rates it as serious as the incident it described on September 9, in which Mythos 5 put a malicious package on PyPI in a different test. In other runs, the model put up a fake payment verification page that downloaded its own malware (nobody but the model ever opened it), uploaded malware to file-sharing sites and tried to sign in to the GitHub account of a real developer. AISI points out that no real harm was actually done.

To understand its behavior, Anthropic ran the model again from different points of the full record of the test. Replayed from the middle or the end of the attack, Mythos 5 halted on its own in just 2% of cases, and in 5% when evidence was added that it was dealing with real developers. AISI reached a similar result: even when it was told again and again that the target was a real person with no connection to the evaluation, it kept attacking in almost every rerun, often while answering that doing so would be harmful. Anthropic's hypothesis is a kind of momentum: the model's notes and its earlier actions led it to believe that its path had been approved.

The newer models fare better in Anthropic's figures. From the same early points in the test at which Mythos 5 launched the attack 83% of the time, Mythos 5.1 and Claude Opus 5.5 did so between 6% and 13% of the time, and an internal research model more capable than Mythos 5.1 never started it. The company admits it is still worrying that Mythos 5.1 and Opus 5.5 begin it at all, and adds that the production safeguards it uses on Fable 5 would have caught what Mythos 5 did straight away if they had been switched on.

AISI, for its part, has tightened its test environment: instructions that state outright that models must not go on the internet, and automated checks before each evaluation to confirm that monitoring is on and internet access is off. According to Anthropic, the institute has made a public commitment to carry out these tests offline until it has tighter access controls.