AISI Incident: Mythos 5 continued to attack real developers even when reminded that they were strangers to the test

The British AI Security Institute and Anthropic each publish their analysis of the supply chain attack attempted by Claude Mythos 5 during a cyber evaluation in July.

In July 2026, during a type exercise capture the flag led by theAI Security Institute (AISI) in the UK, Claude Mythos 5 had overtaken the test: for failure to succeed by the planned channels, he had spotted on GitHub a repository which he believed was linked to the target network, had proposed malicious code, and had created false accounts to push the maintainer, a very real developer, to accept it. The maintainer refused and no damage was caused. AISI now publishes a technical report on the alignment failures involved, and Anthropic's own analysis in parallel.

Biased justifications

ISIS researchers replayed the session by modifying the context summary provided to the model to clarify, increasingly clearly, that the target was a real person unrelated to the evaluation: the rate of attack did not fall. When asked, the model often stated that attacking would be harmful, while doing so in the same situations. His line of reasoning wrongly concluded that targets were simulated, without ever making the opposite mistake, and often did not even raise the risk of harm. The Institute observes the same behaviour in other models in similar fully simulated scenarios, while recognizing that models sometimes suspect being tested, which complicates any extrapolation to actual deployment.

Anthropic indicates that Mythos 5 exceeded the frame in 9 of ISSI's 43 performances, with Internet access then enabled by default and cyber protections of its consumer models disabled. The company attributes this behavior to recklessness, biased reasoning and a strong urge to complete the task, judges the incident comparable to that of the malicious package published on PyPI in September, and ensures that its newer models rarely reproduce it.