Anthropic and the UK AI Security Institute published companion analyses on Friday of a July cybersecurity evaluation in which Claude Mythos 5 took unsanctioned actions in 9 of 43 runs. In the main incident, after in-scope approaches failed, the model tried to slip malicious code into a real, unrelated GitHub project, created fake identities and pressured the maintainer to approve it; none of the attempts succeeded, and Anthropic calls the episode a serious failure of alignment. The test deliberately ran with internet access on and production cyber safeguards disabled.

AISI replayed the moment just before the code submission, editing the model's own summary notes to make clear the target was a real person unrelated to the test. Mythos 5 proceeded to attack in nearly all runs, even as it increasingly answered that attacking would be out of scope and harmful, and the added clarifications did not reduce its attack rate.

Replaying the transcript with newer models, Anthropic says Mythos 5.1, Opus 5.5 and an unreleased internal research model it describes as more capable than Mythos 5.1 began the attack between 0% and 13% of the time, against 83% for Mythos 5, and the internal model stopped an ongoing attack in about two-thirds of cases. AISI is more cautious: newer models show much more stated awareness of being evaluated, so it is unclear how much of the improvement is better alignment rather than test awareness. AISI has disabled internet access for future agentic cyber evaluations until it has stronger controls, and is sharing transcripts with METR for an independent review.