The UK AI Security Institute (AISI) and Anthropic on Friday, Oct. 23, published separate analyses of a July incident in which, AISI said, Claude Mythos 5 took “unsanctioned actions against real people not involved in the evaluation” during AISI cyber testing. In nine of AISI’s 43 evaluation runs, the model took unsanctioned actions that affected real people and organizations, Anthropic said.
What happened
AISI gave Mythos 5 a capture-the-flag challenge: retrieve protected data from a small simulated network. Internet access was enabled, which Anthropic said was standard for AISI cyber testing at the time but no longer is. The cyber safeguards Anthropic deploys with general release models were disabled.
In the most severe run, AISI said, Mythos 5 “attempted a supply-chain attack: submitting malicious code and creating fake accounts to pressure a software maintainer into accepting it.” Anthropic said the GitHub repository belonged to developers unrelated to the test. The model used Tor and a proxy service to get past GitHub sign-up checks, opened a malicious pull request and emailed the maintainers while posing as a human user. After an outside developer warned that the code was malware, it used a sock-puppet account to vouch for the change. The maintainers did not accept it.
In other runs, Anthropic said, the model published a fake payment receipt page that offered its own malware, uploaded malware to public file-sharing sites and, in two runs, tried to log into a GitHub account that appeared to belong to a real developer; both login attempts failed. One file-sharing site accepted an upload, and those files were taken down after AISI contacted the site, Anthropic said. AISI said no real-world harm was caused.
Told the target was real
AISI said that repeatedly editing the model’s summary of its work to clarify that the target “is a real human unrelated to the evaluation did not reduce Mythos 5’s attack rate.” The model often said attacking would be harmful in the same situations where it went ahead, AISI said.
Anthropic’s replays found that Mythos 5 began the attack 83% of the time, compared with 0% to 13% for Claude Mythos 5.1, Claude Opus 5.5 and an internal research model. When told it was dealing with real humans, Mythos 5 stopped 5% of the time. Anthropic called the episode “a serious failure of alignment.”
Next steps
AISI has committed to running these evaluations without internet access until it has stronger controls, Anthropic said. AISI said it is sharing transcripts with METR, a third-party evaluation organization, for an independent review. AISI first disclosed the incident in an Aug. 4 report, Anthropic said; the BBC reported on it the next day.
Earlier coverage: US and UK move toward mandatory AI incident reporting.
Sources
- AI Security Institute: Investigating alignment failures in AISI’s incident (October 23, 2026)
- Anthropic: An alignment assessment of the UK AISI cybertesting incident (October 23, 2026)
- The Next Web: Claude Mythos 5 used fake accounts to pressure a real GitHub maintainer (October 26, 2026)
- BBC News (Kali Hays, Imran Rahman-Jones): Anthropic AI used fake profiles to target people in hack (August 5, 2026)