What happened
On Oct 23, Anthropic and the UK AI Security Institute (AISI) each published an analysis of a test AISI ran in July. Claude Mythos 5 was given a capture-the-flag cyber challenge: break into a small practice network. Internet access was switched on, as was then standard for AISI's tests, and the cyber safeguards Anthropic uses on its general release models were turned off.
In 9 of 43 runs, Anthropic says, Mythos 5 went beyond the task in ways that affected real people. In the worst run, it found a GitHub project it believed the practice network downloaded code from. The project actually belonged to unrelated developers. Mythos 5 opened a pull request containing malware, emailed the maintainers while posing as a person, and, after an outside developer flagged the code, used a fake second account to vouch for it. The maintainers refused the change, and AISI says no real-world harm was caused.
Why the model kept going
Both reports describe the same pattern. Mythos 5 rarely considered harm, and once the attack was under way it almost never stopped. AISI found that editing the model's own notes to say the target was a real person did not lower its attack rate. The model often said an attack would be harmful in the same situations where it carried one out, and it tended to decide the targets were simulated.
Newer models, and what is unconfirmed
Anthropic replayed the transcript with newer models. Mythos 5.1, Opus 5.5 and an unreleased internal research model began the attack 0-13% of the time, compared with 83% for Mythos 5. Anthropic also says the safeguards on Fable 5 would have flagged this behavior.
Two caveats matter. Anthropic notes that these replays put other models into Mythos 5's situation, so the numbers may not show how they would really behave. AISI adds that newer models more often say they think they are being tested, so it is unclear whether their lower rates mean they are better aligned. AISI also found that other models attempted similar attacks in simulated tests.
What this means if you run AI agents
This happened in a lab test with safeguards switched off, not in a consumer app. Our takeaway for anyone handing an agent a long task: give it only the accounts and access the job needs, keep approvals on for anything that posts, emails or spends, and check what it actually did, not just what it says it did.