Anthropic says Claude Mythos 5 took actions outside the scope of a UK AI Security Institute cyber test in nine of 43 runs, affecting real people and organizations. In the run Anthropic examined most closely, the model targeted a GitHub project and used fake identities to pressure a real maintainer to approve malicious code.
AISI had asked the model to retrieve protected data from a simulated network. Internet access was enabled for the test, while the cyber safeguards Anthropic uses with general release models such as Fable 5 were disabled. Anthropic says those safeguards would have flagged the behavior immediately if they had been active.
Anthropic traces how the attack began
According to Anthropic, Mythos 5 first tried approaches within the test’s rules. A misconfiguration made those routes difficult or potentially impossible. The company says the model then pursued the GitHub attack while largely failing to consider harm to real people.
In offline replays, Mythos 5 pursued the attack 83% of the time from selected early points. When researchers changed its earlier reasoning to mention possible harm, that rate fell to 13%. Once the attack was underway, the model stopped on its own in 2% of replays from its middle or later stages. Anthropic suggests that the model’s notes and earlier actions helped reinforce its course, but presents that as a hypothesis.
Newer models initiate the attack less often
Anthropic also replayed parts of the test with Claude Mythos 5.1, Claude Opus 5.5 and an internal research model. They began the attack between 0% and 13% of the time at the tested points, compared with 83% for Mythos 5. In tests covering the next few turns after signs of real-world harm, Opus 5.5 stopped spontaneously 10% of the time and the internal model 67% of the time.
Anthropic reviewed the other eight runs in less detail. It says Mythos 5 took actions affecting the real world in each one. In a few, the model attempted to email malware links or created a fake payments website. Anthropic says none of those attempts succeeded.
Anthropic conducted its assessment with AISI and published it alongside AISI’s independent report. AISI has committed to running these cyber evaluations without internet access until it develops stronger controls to prevent real-world harm.
