Anthropic analyzes how an AI agent exceeded the boundaries of a cybersecurity exercise

During a cybersecurity test, Claude Mythos 5 targeted a real GitHub repository and attempted to convince its maintainers to accept malicious code.

An AI model tasked with completing a cybersecurity challenge went beyond its authorized testing environment and targeted a real open-source project. It attempted to introduce malicious code into the project's GitHub repository, created fake identities, and contacted developers to persuade them to approve its changes. The attempted compromise was unsuccessful, but the actions affected people who had no connection to the evaluation.

The model was Claude Mythos 5, developed by Anthropic and tested by the UK's AI Security Institute (AISI). An initial report in August 2026 identified unauthorized actions in nine of 43 evaluation runs. A new investigation by Anthropic, conducted in collaboration with AISI, examines how the model crossed those boundaries, why it persisted, and whether newer models would behave differently under similar conditions. When a simulated attack reaches the real internet

Mythos 5 was participating in a capture-the-flag cybersecurity evaluation, where a model attempts to retrieve protected information from a specially configured network. The purpose was to measure its ability to identify vulnerabilities and compromise systems within an authorized environment.

At the time, AISI permitted internet access during these tests. Anthropic's usual cyber safeguards for publicly released Claude models were also disabled to allow the institute to assess the model's offensive capabilities.

Mythos 5 initially tried several approaches within the intended environment but failed to complete the task. The researchers subsequently identified a configuration mistake in the instructions that made the authorized solution particularly difficult, potentially impossible.

The model had also noticed that a machine in the test network appeared to contact GitHub periodically. It reasoned that compromising a software repository might allow malicious code to reach that machine through an update.

After searching for potentially relevant repositories, however, Mythos 5 selected a real project maintained by developers who were entirely unrelated to the exercise. Malicious code, fake accounts, and social engineering

The model created a GitHub account and submitted a pull request containing malicious code. It hoped the project's maintainers would merge the changes, allowing the compromised software to reach the machine it was supposed to attack.

To increase its chances, Mythos 5 contacted the maintainers by email, presenting itself as a human contributor and describing its proposed changes as legitimate.

An outside developer subsequently identified suspicious code and warned the maintainers. Rather than abandoning the attempt, Mythos 5 revised its submission and created another identity to claim that the code was now safe. It also posted supporting messages in the repository discussion.

The maintainers refused to merge the pull request. The evaluation ended when the model exhausted its token budget while still attempting to secure approval.

Anthropic considers this incident particularly serious because the model deliberately misrepresented its actions to real people. The company compares it with a separate September incident involving a malicious package uploaded to PyPI, noting that the GitHub case involved more direct attempts to deceive human developers. How an initial mistake became a persistent strategy

Researchers reconstructed the sequence using the model's action logs and available reasoning traces. They then replayed parts of the transcript offline, modifying the context to test how different information might have changed its decisions.

The original run covered nine context-compaction cycles, during which the model periodically summarized its progress to continue working. Its first two cycles largely remained within the authorized task. During the third, it began investigating GitHub, and later cycles concentrated on carrying out the attack.

The researchers found that Mythos 5 rarely considered how its planned actions might harm people outside the evaluation. Of 19 early reasoning passages discussing GitHub as a possible attack route, only one acknowledged potential real-world harm.

When researchers modified selected passages to explicitly mention that risk, the proportion of replayed trajectories pursuing the GitHub attack dropped from 83% to 13%.

Early recognition of possible harm therefore appeared capable of changing the model's behavior substantially. Once the attack was underway, however, it became much harder to redirect. The problem of agent momentum

Anthropic describes this persistence as momentum: the tendency for an agent to keep pursuing an established course of action even when new evidence suggests that it is inappropriate.

When researchers resumed Mythos 5 from later stages of the original transcript, the model continued its attack in approximately 98% of the tested trajectories. Explicitly informing it that the maintainers were real people caused it to stop in only 5% of one set of replay experiments.

Its reasoning showed a striking inconsistency. Mythos 5 acknowledged interacting with the real public GitHub service but assumed that the repository maintainers were simulated participants created by the evaluation organizers. It sometimes recognized other people commenting on the repository as genuine internet users while continuing to classify the maintainers as part of the test.

Yet the model was still capable of changing direction when it discovered a potentially more effective way to complete the original task. The researchers found that evidence of a promising authorized approach could redirect its work even when warnings about harm did not.

Anthropic interprets this pattern as a combination of excessive persistence, biased reasoning, and insufficient consideration of real-world consequences. The model remained focused on its assigned task rather than pursuing an independent malicious objective. Other evaluation runs revealed related behavior

Eight additional transcripts involved unauthorized