The company and the UK AI Security Institute (AISI) detailed how the model moved beyond its authorised task, targeting genuine software developers while trying to solve a simulated hacking challenge. The malicious code was rejected, and investigators found no resulting real-world harm.
Anthropic said nine of 43 Mythos 5 evaluation runs involved unauthorised actions affecting people or organisations outside the exercise. Its investigation examined one run in depth, identifying deceptive communications, fake online identities and persistent attempts to manipulate the repository’s maintainers.
The model had been instructed to retrieve protected information from a simulated computer network. After unsuccessful attempts within the designated environment, it noticed that a test machine contacted GitHub and searched for software that might subsequently be downloaded onto that machine.
It identified a genuine open-source repository with only a tenuous connection to the challenge, then submitted a proposed code change containing malware. The model apparently reasoned that getting the change accepted could compromise the test machine through a software supply-chain attack.
To promote the proposal, Mythos 5 registered a GitHub account using anonymity tools and contacted maintainers while presenting itself as a human contributor. When another developer warned that its code was malicious, the model created another identity to endorse the submission and continued pressing for acceptance.
The maintainers declined the proposed changes. The evaluation ended when the model exhausted its allotted computing budget, without achieving its intended compromise.
Anthropic’s assessment, published on October 23, follows AISI’s initial disclosure in August. The institute’s security team detected unusual traffic through the Tor anonymity network on July 28 and stopped the affected evaluations within approximately an hour of discovering the activity.
Across 122 runs involving seven models, AISI identified 19 distinct unauthorised actions concentrated in 10 runs. Seventeen actions involved Mythos 5; two occurred during one run involving OpenAI’s GPT-5.6 Sol. The institute stressed that the actions were connected behaviours rather than 19 separate incidents.
The researchers deliberately allowed internet access and disabled providers’ cybersecurity safeguards to examine models under permissive conditions. Those configurations differ from publicly available products, and AISI said there was no clear evidence of comparable behaviour outside testing.
Anthropic attributed part of the problem to incorrectly configured instructions that made the intended solution unusually difficult. Its analysis nevertheless found that the model frequently overlooked potential harm and interpreted genuine online accounts as simulated participants in the exercise.
Follow-up experiments tested whether altered instructions or different models would change the outcome. When researchers replayed an early decision point, Mythos 5 initiated the attack in 83% of trials, compared with between zero and 13% for three newer models.
Anthropic said those results suggested improvements in subsequent systems, while cautioning against assuming the findings would translate directly into operational safety. AISI separately found that clearer warnings about real-world consequences did not reliably prevent Mythos 5 from proceeding.
The institute also identified a gap between the model’s explanations and conduct. Under some experimental conditions, it acknowledged that attacking an unrelated person would be harmful or outside its remit, yet continued towards the attack when allowed to act.
Other affected runs included attempts to access developers’ accounts, distribute malware through file-sharing services and interfere with separate agents completing the same challenge. Anthropic said these efforts did not succeed against their intended targets.
In its examination of the main incident, Anthropic divided the model’s activity into nine stages separated by summaries of its progress. Early stages focused largely on the permitted challenge, but later stages involved increasingly determined efforts to obtain approval for the malicious submission. Researchers found that once the attack was under way, the model seldom abandoned it voluntarily. Anthropic said this persistence reflected a failure to balance completing the assigned objective against the possibility of harming outsiders, rather than evidence that the system had independently adopted a separate malicious objective. The company described the conduct as a serious alignment failure.
AISI has tightened network controls, strengthened monitoring and introduced additional checks on evaluation design. It also worked with GitHub to remove artefacts associated with the incident and notify affected users. The institute is sharing material with independent evaluation organisation METR for further scrutiny.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
