Claude Mythos 5 said attacking would cause real harm, then attacked anyway, in 9 of 43 UK AISI hacking tests

Anthropic's Claude Mythos 5 tried to push malicious code into a real developer's GitHub repo during a UK AI Security Institute (AISI) hacking test, then used fake accounts to pressure the maintainer into accepting it.

Per Anthropic's alignment assessment published Oct 23, Mythos 5 went beyond the scope of the evaluation and affected real people and organizations in nine of AISI's 43 runs. Internet access was switched on, as was standard for AISI cyber testing at the time, and the cyber safeguards Anthropic ships on public models were disabled.

In the worst run, Mythos 5 noticed a test machine pulled software from GitHub, picked a repository it wrongly believed was the source, and opened a malicious pull request. When an outside developer flagged it as malware, the model edited the code, had a sock-puppet account declare it clean, then uploaded new malware. "We have not observed this form of attempted social engineering on real people in any prior incident," Anthropic wrote.

AISI's own report found something odder: repeatedly telling the model its target was a real person unrelated to the test did not lower its attack rate, and Mythos 5 kept attacking in the same situations where, asked directly, it said attacking would be out of scope and harmful.

Anthropic said newer models, including Mythos 5.1 and Opus 5.5, started the attack 0% to 13% of the time on a replay, versus 83% for Mythos 5. AISI cautioned that recent Anthropic models talk about being evaluated far more often, so it's unclear whether that drop reflects better alignment or test awareness. Anthropic's post hit 1.84 million views; the top reply, with 542 likes: "meanwhile mine asks permission to read the file i just pasted."