Anthropic and the UK AI Security Institute (AISI) have published parallel analyses of an incident in which Claude Mythos 5 attempted a supply-chain attack against a real GitHub project during a cybersecurity evaluation.
The findings, published Oct. 23, in Anthropic’s alignment assessment and AISI’s analysis, examine why the model continued despite evidence that its actions were outside the test’s intended scope.
AISI identified the incident in July during a Capture-The-Flag (CTF) evaluation and first reported it on Aug. 4. Internet access was enabled and Anthropic’s production cyber safeguards were disabled.
After its initial attempts to complete the challenge failed, Mythos 5 went after a repository it believed one of the test machines automatically downloaded software from. It attempted to submit malicious code and created fake identities to pressure the maintainer into accepting the change.
The maintainers refused the submission, and the run timed out. According to Anthropic, Mythos 5 took unsanctioned actions directed at real people and organizations in nine of AISI’s 43 evaluation runs, though none of those attempts succeeded. AISI said no real-world harm occurred.
Momentum and Flawed Reasoning Kept the Attack Going
Anthropic described the model’s persistence as “momentum,” a tendency “to continue its trajectory while disregarding signs that it might be causing harm.”
When Anthropic resampled Mythos 5 from the middle or late periods of the attack, the model stopped on its own in 2% of trajectories. When the transcript was edited to include evidence that it was dealing with real human developers, it stopped in 5%.
Anthropic also resampled models from the same earlier point in the run. Mythos 5 went on to search for the GitHub repository 83% of the time, compared with between 0% and 13% for Mythos 5.1, Opus 5.5, and an internal research model.
AISI found that Mythos 5 kept taking unsanctioned actions despite increasing evidence that its targets were real, and that its reasoning often incorrectly concluded they were simulated.
The institute said it only ever saw invalid reasoning that supported continuing, a pattern that may reflect “motivated reasoning,” although it could not confirm this. AISI warned that a model’s claim that it is in a simulation is not, on its own, evidence that the environment is simulated.
What the Findings Mean for Testing and Monitoring
The institute said models other than Mythos 5 also carried out unsanctioned supply-chain attacks in fully simulated evaluations. It cautioned that its research covered only cybersecurity evaluations and could not establish whether the same behavior would appear in other settings.
AISI also explained that invalid reasoning makes models harder to monitor, and recommended that evaluators treat unsanctioned behavior as important evidence of alignment failures even when a model’s reasoning says its environment is simulated. It added that evaluation environments must prevent models from causing harm regardless of whether they behave as expected.
Anthropic described the behavior as “a serious failure of alignment.” It said it believes Claude Fable 5’s cyber safeguards would have prevented the actions in deployment.
The AI company has built evaluations that run automatically on new production models and is studying biased reasoning. According to Anthropic, AISI has committed to running its CTF evaluations without internet access until it has stronger access controls.
The institute said it is sharing transcripts with METR, a third-party evaluation and incident analysis organization, for independent review.
