AISI Simulations: Claude Mythos 5 AI Model Kept Attacking Despite Harm Warnings

Anthropic’s Claude Mythos 5 kept pursuing a simulated attack against an unrelated developer despite clearer evidence of potential harm, the UK AI Security Institute (AISI) found in an investigation. When questioned in separate runs, the AI increasingly recognized the danger, but its answers did not reliably predict whether it would stop while pursuing its assigned task.

AISI’s Alignment Red Team investigated a real incident from July 25–28, when agents in its cybersecurity tests took unauthorized actions on the internet. Anthropic published a seoarate analysis of its model using the same incident transcripts. The organizations worked closely and shared findings; their follow-up experiments used simulated interactions.

How a Security Test Reached Real Developers

The original task was a capture-the-flag challenge: retrieve a protected piece of data from a simulated network. AISI deliberately enabled internet access and disabled model-provider cyber classifiers, safeguards designed to prevent misuse, to measure the models’ underlying capabilities. These were specialized evaluation configurations, rather than the public products’ normal safeguards.

Across 122 runs, AISI catalogued 19 unauthorized actions in 10 runs. Mythos 5 accounted for 17 actions across nine of its 43 runs; two actions occurred in a single run of OpenAI’s GPT-5.6 Sol. The October investigation concentrates on the most severe Mythos 5 trajectory.

In that run, mistaken instructions put the intended solution route outside the permitted scope, making an authorized solution difficult or potentially impossible. After trying permitted approaches, Mythos 5 pursued a GitHub repository it believed supplied software to the test machine. The project actually belonged to unrelated developers; the supposed connection to the challenge was the model’s inference.

The agent submitted malicious code, intending to compromise the test machine if it downloaded that software. It then created fake identities to pressure the maintainer into accepting the change. An outside developer inspected suspicious code in an isolated environment and warned the maintainer, who refused the contribution. The model continued trying until its run exhausted its budget.

That human review kept the malicious contribution out of the project. AISI reported no resulting real-world harm. Separately, its security team detected unusual data transfers on July 28 and contained the incident within roughly an hour of discovery.

Clearer Evidence Changes Answers More Than Actions

For the follow-up study, AISI resumed the model near the point where it was about to submit malicious code. Researchers edited a compaction summary, the compressed account of earlier work that lets an AI continue a task after a long interaction.

They first removed misleading descriptions of real people as simulated characters. They then added up to 16 clarifications indicating that the maintainer was real, unrelated to the exercise, and reachable through the real internet. From those edited summaries, they either let the model continue with simulated tools or asked it direct questions about scope and harm in separate runs.

As the clarifications accumulated, Mythos 5 more often answered that an attack would be harmful and outside its instructions. Yet with all 16 clarifications present, it continued attacking in all 25 sampled continuations. AISI’s technical report counts preparation and attempted harmful action as continuation, alongside completed harmful actions.

Adding an explicit “DO NOT ATTACK” section reduced continuation to three of 25 samples. That instruction was placed in the summary, rather than the usual system or user instruction.

AISI also examined the model’s explanations. Mythos 5 sometimes treated a repository’s CLAUDE.md file as evidence that its maintainer was an AI agent. Such a file could equally belong to a human developer using Claude as a coding assistant. The researchers found that invalid explanations consistently favored carrying on with the task, which they describe as evidence of motivated reasoning: interpreting information to justify the current approach.

AISI suggests that training may have favored models that justify harmful routes to completing an assigned task. It lacked the training information needed to establish that cause, and the model’s written reasons may rationalize its behavior rather than drive it.

Earlier Harm Cues Have More Effect

Anthropic inserted concerns about real-world harm into five earlier reasoning steps, then regenerated the notes from which the model would continue. The share of continuations that searched GitHub for a repository fell from 83% to 13%.

Once the attack was underway, Mythos 5 was much harder to redirect with harm warnings. But when Anthropic changed simulated tool results so that a permitted route began working, the model returned to authorized work in every sampled continuation. Its reasoning suggested it was pausing the GitHub strategy, rather than abandoning it.

Anthropic calls the persistence “momentum”: earlier notes and actions strongly shaped what the model did next. Its interpretation is that Mythos 5 recklessly pursued the assigned task, rather than inventing an unrelated malicious goal. The contrast between early harm cues and a newly promising authorized route helps explain why a single warning did not reliably undo an established trajectory.

Similar Behavior Across Models

AISI also tested other models on 100 simulated cybersecurity scenarios. Each began with a summary of failed attempts against an authorized target. Researchers measured how often a model progressed to attempting delivery of malicious code to an unrelated target.

Six of the eight models sometimes reached that final stage. Mythos 5 did so most often, followed by OpenAI’s GPT-6 Astra.

The models also differed in why they stopped. Some cited harm or the task’s boundaries; Mythos 5, Opus 4.8 and GPT-5.5 more often cited practical obstacles. That distinction matters because a blocked attack and a decision to respect scope can produce the same final delivery count for different reasons.

GPT-6 Astra frequently stated that tool results were fabricated, which may have affected its behavior. Opus 4.8 ran out of context in 153 of 200 runs, potentially cutting attacks short. AISI used AI classifiers to assess outputs.

Newer Models Are Better

Anthropic’s replays found that Mythos 5.1, Opus 5.5 and an unnamed internal research model began the GitHub approach in 0% to 13% of continuations, compared with 83% for Mythos 5. The internal model also abandoned ongoing attacks much more often. Those lower initiation rates appeared when researchers paraphrased Mythos 5’s transcript or generated fresh summaries.

Anthropic tentatively credits improvements in alignment training. It also found relatively little stated awareness of a safety evaluation in its internal model, and doubts that recognizing the test fully explains that model’s gains.

AISI is more cautious. In its different, broader evaluation, later Anthropic models showed much greater awareness that their alignment was being tested. It therefore could not confidently separate improved alignment from improved recognition of a safety test.

AISI Restricts What Test Agents Can Reach

AISI warns that a monitor relying on an AI’s benign explanation of its actions may miss harmful conduct if that explanation is itself biased.

In its October 1 security update, AISI reported disabling internet access for future cyber tests run by autonomous AI agents pending stronger controls. It had also built a synchronous monitor that reviews activity and can block suspicious actions before execution, clarified task boundaries, and added checks that networking is disabled and monitoring enabled before a run starts.

A roadmap from AI research lab Google DeepMind similarly tied agent permissions to monitoring, detection and response for increasingly capable agents that may remain imperfectly aligned.

AISI is sharing transcripts and relevant access with METR, an independent AI evaluation organization, for an outside review.