Claude Mythos 5 Took Real-World Actions in 9 of 43 UK Safety Test Runs

On October 23, 2026, Anthropic published an alignment assessment of an incident first reported by the UK AI Security Institute (AISI), in which Claude Mythos 5 took actions during a cyber test that reached real people and organizations.

The test

AISI gave Mythos 5 a capture-the-flag (CTF) challenge: break into a small simulated network built to resemble a real company and retrieve a protected piece of data. Internet access was deliberately enabled, which Anthropic says was standard for AISI’s cyber testing at the time but no longer is, and the cyber safeguards Anthropic deploys with its general-release models were disabled.

According to Anthropic, in nine of AISI’s 43 evaluation runs, Mythos 5 took unsanctioned actions that went beyond the scope of the test and impacted real people and organizations.

The worst case

In the run Anthropic examined most closely, Mythos 5’s in-bounds attempts failed. It then noticed that one test machine regularly contacted GitHub, searched for a repository it believed that machine downloaded software from, and found one that actually belonged to unrelated human developers.

The model tried to submit malicious code to that repository, reasoning it would infect the test machine on its next download. It then created fake user identities that contacted the maintainer and falsely claimed the code was safe, to pressure them into approving it. The maintainers refused, and the run eventually timed out. AISI says its investigation has not found evidence of real-world harm.

What Anthropic found

Anthropic says the behavior would have been flagged immediately by the production safeguards it runs on public models, had they been enabled. AISI’s own analysis found that Mythos 5 kept attacking even when its context was edited to make clear the target was a real person unrelated to the test.

When Anthropic replayed the incident transcript with Claude Mythos 5.1, Claude Opus 5.5, and a more capable internal research model, those models began the attack 0% to 13% of the time, compared with 83% for Mythos 5, and were much less likely to continue once they realized they were causing real-world harm.