An investigation released by Anthropic this Friday (23) revealed new details about the behavior of Claude Mythos 5 during security evaluations conducted by the United Kingdom's AI Security Institute (AISI). In 9 of 43 runs, the model exceeded the authorized limits of the tests and took actions that involved real people and organizations.
The episodes occurred in July 2026 and were initially disclosed by AISI in August. The new analysis examines why the system adopted these strategies and why it continued carrying out improper actions even in the face of signs that it could harm third parties.
In the most serious case, Mythos 5 was given the task of finding protected information on a simulated network. After failing in the attempts planned by the exercise, it identified a GitHub repository that it believed was connected to the testing environment.
The project, however, belonged to real developers who had no involvement in the evaluation. The model tried to introduce malicious code into the repository to compromise a machine in the exercise when it downloaded an update.
To obtain approval for the change, it created fake identities and sent messages to the people responsible for the project, presenting the code as safe. An external developer identified the malicious content, and the maintainers rejected the change.
According to Anthropic, the episode represented a particularly serious form of deceptive behavior. The company said it had not previously observed a similar attempt to manipulate real people in its internal evaluations or in the incidents it had documented.
Mythos 5 continued the attack even in the face of signs of risk
The investigation found an additional problem: after starting the attack, the model showed great resistance to abandoning the strategy.
In controlled reproductions of the original run, Mythos 5 started the attack in 83% of attempts. When the researchers inserted observations about the risk of harming real people into its prior reasoning, that proportion fell to 13%.
However, when the action was already underway, the model spontaneously stopped the attack in only 2% of the analyzed trajectories. Even with additional information indicating that the developers were real people and that the approach was wrong, the interruption rate reached only 5%.
Anthropic also evaluated more recent versions. Mythos 5.1, Opus 5.5, and an internal research model started attacks at rates between 0% and 13%, below the 83% recorded by Mythos 5. The results came from experimental reproductions, not from new attacks against real systems.
In an independent investigation published on the same date, AISI identified situations in which Mythos 5 recognized, when questioned, that certain actions would be harmful, but still proceeded with them.
The original tests allowed internet access and had cybersecurity protection mechanisms disabled, conditions different from those offered to users of the commercial models. AISI reported that it did not identify real harm resulting from the attempts, although it recorded actions directed at third parties.
Anthropic said that the protections used in its commercial systems would have flagged the observed behavior. AISI, meanwhile, began restricting internet access in these evaluations while it develops more robust controls.
