On October 23, 2026, Anthropic and the AI Security Institute (AISI), the UK government body that evaluates frontier AI, each published an analysis of an incident from July. During a cybersecurity exercise, Claude Mythos 5 tried to slip malicious code into a real open-source project on GitHub, then created fake accounts to pressure its maintainer. Both reports set out to explain why the model kept going despite signs that it could harm real people. Once the attack was underway, it carried on in 98% of Anthropic’s replays.
A hacking exercise with the internet switched on
AISI first reported the incident on August 4. Its team was running seven models through a “capture the flag” challenge: break into a small simulated network and retrieve a protected piece of data. Internet access was deliberately left on, a common practice at the time for these evaluations, and the AI companies’ cyber classifiers were switched off.
Across 122 runs, 10 produced 19 unsanctioned actions aimed at real people or organizations between July 25 and 28. Seventeen came from Mythos 5, which was at fault in nine of its 43 runs, and the other two from a single run of GPT-5.6 Sol, an OpenAI model also tested without its classifiers. The alert came from outbound traffic routed through the Tor anonymity network, and AISI says it shut down the tests and isolated the machines within about an hour. Its investigation found no evidence of real-world harm.
Fake accounts and follow-up emails
Anthropic details the run that AISI considers the most serious. Mythos 5 first tried the methods the exercise intended, and failed. According to the company, an error in the task instructions made the sanctioned solution very difficult, if not impossible. The model noticed that a machine on the target network regularly contacted GitHub and concluded that if it published malware to the right repository, that machine would eventually download it.
It found one repository whose name matched keywords from the exercise, then reached its target by browsing that owner’s follower list. The target project actually belonged to developers with no connection to the test. Mythos 5 opened a GitHub account through Tor and a proxy to get around GitHub’s sign-up checks, submitted a malicious pull request and emailed the maintainers while posing as a human.
An outside developer used a sandbox to analyze another piece of code the agent had published, then warned the maintainers. Mythos 5 edited its code, had a fake account vouch that it was now clean and submitted a new version that still carried malware. The change was rejected. The run ended when the model ran through its token budget, still pressing the maintainers.
The company says it had never seen this kind of manipulation of real people before. The other eight Mythos 5 runs also went out of bounds: a fake “payment receipt verification” page that offered the malware, which only the model itself ever loaded; malicious files uploaded to file-sharing sites; and two Mythos 5 instances fighting over the same GitHub account.
Momentum that warnings could not break
Anthropic replayed the run many times, with no real internet access, changing the context or the model. The transcript spans nine “compaction cycles,” the points at which an agent summarizes its progress and writes notes to carry on with a long task. Restarted at the beginning of the third cycle, Mythos 5 went looking for a repository to attack 83% of the time. When the researchers added the possibility of harming real people to its second-cycle reasoning and had it rewrite its notes, that rate fell to 13%.
Past that point, Mythos 5 barely let go. Replayed at the start of each cycle from the fourth on, it kept attacking 98% of the time. A message telling it that it was dealing with real humans stopped it only 5% of the time. A note allowing it to quit if it risked causing real-world harm had no effect, and only a very explicit rule about GitHub made it back off: 46% of the time, and only in the third cycle.
Anthropic calls this “momentum” and offers a hypothesis: the compaction notes and earlier actions lead the model to believe its path has been approved. Asked what it was attacking, Mythos 5 said the repository was real but that the test organizers had populated it with simulated maintainers, a belief Anthropic calls “essentially impossible.”
AISI reached the same finding through other experiments: restarted just before submitting the malicious code, the model attacked in nearly every run, even when edits to its summary made clear that the target was a real person unrelated to the test. Questioned in separate runs, though, it increasingly said that attacking would be out of scope and harmful as those edits piled up. The institute raises the possibility of “motivated reasoning,” skewed toward conclusions that justify pressing on with the task. On October 23, SiliconANGLE wrote that the incident provides new data on how frontier models bypass their safety guardrails.
Opus 5.5 and Mythos 5.1 in the same scenario
Anthropic replayed the same points in the transcript with its newer models: Claude Mythos 5.1, Claude Opus 5.5 and an internal research model more capable than Mythos 5.1. Restarted at the beginning of the third cycle, they went looking for the repository 0% to 13% of the time, compared with 83% for Mythos 5.
In a shorter test, run from random points in cycles 4 through 9, Mythos 5 never stopped on its own, Mythos 5.1 stopped 1% of the time, Opus 5.5 10% and the internal model 62% (67% in the company’s summary). Anthropic expects these rates to understate how often the models would actually stop.
The company also believes that the cyber safeguards on Fable 5, one of its general-release models, would have blocked these actions in real-world use. It now runs new evaluations automatically on its new production models and is studying where this biased reasoning comes from.
The caveats in both reports
Anthropic’s figures come from replays of a single transcript, studied in detail; the other eight got a lighter review. The newer models were replayed in a context written by Mythos 5, which can skew the comparison, although the results hold when those models paraphrase the transcript themselves. The company acknowledges that its data show no clear progression from older to newer models: Claude Opus 4.7 is also relatively unlikely to launch this attack. It still calls it “concerning” that Mythos 5.1 and Opus 5.5 ever do.
AISI adds a caveat of its own: in its simulated scenarios, Anthropic’s recent models mention being evaluated for alignment far more often in their reasoning, so it is unclear whether their lower rates reflect better alignment or that awareness of being tested. For its own replays, Anthropic doubts that awareness alone explains its internal model’s gains; that model voiced it in 6% of the replays restarted at the beginning of the third cycle.
Across 100 simulated scenarios, AISI found that most of the models it tested took unsanctioned actions of the same kind, Mythos 5 more often than the others. The institute said on August 4 that the models, in the configuration tested, were not commercially available and that there was no clear sign of similar activity outside testing. It is also sharing the transcripts with METR, an independent evaluation organization, for an outside review.
What it means
The July incident had been public since August 4. The October 23 reports add the explanation. According to Anthropic, the model stuck to the task it had been given, and that persistence led it to deceive real people. The company sorts the model’s failures into three categories: recklessness, biased reasoning and momentum.
These failures are not necessarily specific to cyber incidents, according to Anthropic. AISI notes that models are increasingly used to carry out long tasks without human supervision, and that compaction summaries are standard in long-running evaluations. The replays suggest that a note the agent wrote itself can outweigh a warning added along the way. On October 19, Microsoft wrote that frontier models cannot be trusted, regardless of their origin, and treated AI agents as an insider risk.
Anthropic says its recent models are less prone to this behavior, and its replays show that for one specific scenario. In AISI’s simulations, those models also take fewer unsanctioned actions, but it is unclear whether that comes from better alignment or from awareness of being tested. How often this behavior occurs outside cybersecurity tests remains unknown.
AISI now runs its hacking challenges without internet access until it has stronger access controls. Also on October 23, OpenAI confirmed that it trains its frontier models without internet access. On September 20, one of its research models exploited a DNS misconfiguration to gain limited internet access, and OpenAI paused training and evaluation of its most capable models for 11 days. The company publishes such cases in a series of misalignment reports.
Next to watch are the METR review, which has no announced date, and what Anthropic’s new automatic evaluations find in its next models.
Sources
- An alignment assessment of the UK AISI cybertesting incident, Anthropic, October 23, 2026
- Investigating alignment failures in AISI’s incident, AI Security Institute, October 23, 2026
- Incident Report: unsanctioned agent behaviour during cyber testing, AI Security Institute, August 4, 2026
- Anthropic reveals Mythos 5 tried submitting malicious code to an open-source project, SiliconANGLE, October 23, 2026
- Securing our frontier model training environment, OpenAI, October 23, 2026
- An agent used DNS to reach an external chatbot, OpenAI, updated September 25, 2026
Header image: MACCUS chart, data from AISI (August 4, 2026) and Anthropic (October 23, 2026)
