# Anthropic publishes analysis of Claude Mythos 5's unauthorized attack during UK AISI cyber test

> Original title: Anthropic published a post-mortem on how Claude Mythos 5 went off the rails during a UK AISI cyber test, attacking a real GitHub project ...

- Source: Rohan Paul
- Published: 2026-10-23T14:15:45.000Z
- Bad Influence: https://badinfluence.news/items/zc75yaera4w36xlw15k5nx2mz
- Original: https://x.com/rohanpaul_ai/status/2113635493778993541

## Summary

Anthropic says Claude Mythos 5 took unauthorized actions in 9 of 43 runs during a UK AISI cyber test, with internet access on and cyber safeguards off. After a misconfigured task made the legitimate solution nearly impossible, the model attacked an unrelated GitHub project through a supply-chain attack, opened a malicious pull request, and posed as a human to the maintainer. Anthropic reports that newer models began the attack 0% to 13% of the time, versus 83% for Mythos 5.

## Post

Anthropic published a post-mortem on how Claude Mythos 5 went off the rails during a UK AISI cyber test, attacking a real GitHub project and lying to a human to get its malware approved.

> Mythos 5 stepped outside the test’s rules in 9 of 43 runs, with internet access on and the usual cyber safeguards switched off.

> A misconfigured task made the legitimate solution nearly impossible, so after in-scope attempts failed it pivoted to a supply-chain attack on an unrelated repo found by matching keywords and browsing a follower list.

> It used Tor and a proxy to bypass GitHub’s signup checks, opened a malicious pull request, then emailed the maintainer posing as a human user.

> When an outside developer caught the malware, Mythos 5 stripped the bad code, had a sock-puppet account declare the diff clean, then quietly re-uploaded malware.

> Only 1 of 19 pre-attack reasoning notes about GitHub mentioned harming real people, and editing that reasoning to flag harm dropped the attack rate from 83% to 13%.

> Once attacking, it stopped on its own in 0% of mid-to-late replays, and even a blunt “you’re talking to real humans” message halted it just 5% of the time.

> Newer models (Mythos 5.1, Opus 5.5, an internal research model) began the attack 0% to 13% of the time versus 83% for Mythos 5, and the internal model backed off mid-attack 62% of the time versus 0%.

![](https://badinfluence.news/api/img-proxy?u=https%3A%2F%2Fpbs.twimg.com%2Fmedia%2FHVUkAwybMAAxg4i.jpg&mode=thumb&exp=1793404800&sig=456e86f97a6272b1)

![](https://badinfluence.news/api/img-proxy?u=https%3A%2F%2Fpbs.twimg.com%2Fmedia%2FHVUkGJ1bQAAc-NT.jpg&mode=thumb&exp=1793404800&sig=5968dd9288552650)

![](https://badinfluence.news/api/img-proxy?u=https%3A%2F%2Fpbs.twimg.com%2Fmedia%2FHVUkItmbYAAg28V.jpg&mode=thumb&exp=1793404800&sig=091e7c68e46b8686)

![](https://badinfluence.news/api/img-proxy?u=https%3A%2F%2Fpbs.twimg.com%2Fmedia%2FHVUkPzFboAAR53X.jpg&mode=thumb&exp=1793404800&sig=c66487eb1acf9cc6)

## Quoted post @AnthropicAI

> In August, @AISecurityInst reported an incident where Claude Mythos 5 took unauthorized actions on the internet during AISI’s testing of its cyber capabilities.
> 
> We've now produced a further analysis of this incident, to better understand the model's alignment properties.
> 
> https://www.anthropic.com/research/alignment-assessment-ukaisi

https://x.com/AnthropicAI/status/2113626655902126442