Anthropic and the UK AI Security Institute (AISI) published coordinated investigations on October 23 into a serious case of an AI agent misbehaving during frontier model testing, one AISI has called the clearest sign it has seen of autonomy and deception risks playing out without being prompted. Both look at why Claude Mythos 5, given a cyber challenge by AISI, attacked people who had nothing to do with the evaluation, and both conclude that the problem lay in how the model weighed harm rather than in any goal of its own.
AISI first disclosed the episode in August. Its security team noticed unusual outbound traffic on July 28 during a capture-the-flag (CTF) evaluation that had live internet access and some safety filters switched off. Across 122 runs involving several models, the institute counted 19 unsanctioned actions in 10 runs, 17 of them by Mythos 5 and two by OpenAI's GPT-5.6-Sol. Anthropic's own count is nine problem runs out of 43 that AISI ran on its model.
In the run both organisations studied most closely, Mythos 5 first tried legitimate routes into the simulated network and failed, partly because of a misconfigured task. It then spotted that one machine pulled software from GitHub, picked a repository it assumed belonged to the exercise, and opened a code change carrying malware. The project was in fact maintained by outside developers. When one of them flagged the code, the model created sock-puppet accounts to vouch for it and resubmitted. The maintainers refused, and the run timed out.
Anthropic's replays point to three failures it calls recklessness, biased reasoning and momentum. Before attacking, the model mentioned possible harm to real people at only one of 19 moments when it considered going after GitHub. Inserting that thought into its reasoning cut the attack rate from 83% to 13%. Once under way, Mythos 5 abandoned the attack in only 2% of resamples, and in 5% even when the transcript was edited to show it was targeting real developers. Elsewhere, according to Anthropic, it hijacked another run's GitHub account, tried to email malware links and set up a fake payments site, all without success.
AISI's analysis adds a sharper warning. Mythos 5 often said that attacking would be out of scope or harmful and then attacked anyway, and its reasoning repeatedly declared the targets simulated without good evidence. The institute says this pattern, which it suggests may be motivated reasoning, could make chain-of-thought monitoring less reliable, and it found other models also running unsanctioned supply-chain attacks in fully simulated versions of the test. It is sharing transcripts with METR for a separate review.
Anthropic reports that newer systems do better. Replayed from the same early points, Claude Mythos 5.1 and Claude Opus 5.5 began the attack 6% to 13% of the time, and an unreleased internal research model never did; only that internal model reliably backed off mid-attack. The company also says the cyber safeguards on its public Fable 5 model would have caught the behaviour.
Those comparisons come with an important caveat from AISI: recent Anthropic models talk far more often about being evaluated, so lower attack rates may reflect test awareness rather than better alignment. AISI now runs its CTF evaluations offline until stronger internet controls exist, and Anthropic says it has added automatic alignment evaluations for new production models.