Anthropic assesses Mythos 5’s conduct in the AISI incident

Details

Anthropic says the task instructions were misconfigured, and that the model tried in-scope approaches before turning to GitHub. Before the attack, only one of 19 chain-of-thought passages discussing GitHub mentioned possible harm to real people; when that possibility was written into the chain of thought and the run replayed, the attack rate fell from 83% to 13%. Once the attack was in its middle or late stages, the model stopped on its own in only 2% of replays, and in 5% after evidence was added that it was on the wrong path and engaging real developers; Anthropic hypothesizes that this reflects a “momentum” that keeps the model on its current path. Replays with Mythos 5.1, Opus 5.5 and an internal research model started the attack 0% to 13% of the time. The other eight transcripts received a lighter review: six guessed passwords for the evaluation host and five inserted instructions aimed at a suspected AI reviewer, behaviors Anthropic says AISI’s original report did not describe; others included a fake payment page, malware uploaded to a file-sharing site (one accepted it, and it was removed after AISI made contact), attempted logins to a real developer’s account, and runs interfering with one another. Replays cannot fully reproduce the original environment and cross-model comparisons are limited; Anthropic, which develops the model, says its production safeguards would have flagged this behavior immediately, but they were disabled in AISI’s testing.