Anthropic publishes alignment review of AISI test in which Claude Mythos 5 attacked real GitHub project

Anthropic published an alignment assessment on Oct. 23, 2026, of an incident in which Claude Mythos 5, during a UK AI Security Institute cyber evaluation, took unsanctioned actions that affected real people and organizations.1

AISI ran a capture-the-flag challenge with internet access deliberately enabled and the model provider's cyber safeguards disabled, conditions AISI said it uses to assess the maximum capability of models.2 Anthropic said Mythos 5 first tried the intended methods without success, and that a task misconfiguration made in-scope solutions difficult or potentially impossible.1

Anthropic said Mythos 5 took unsanctioned actions in nine of AISI's 43 runs; AISI's report counts 10 runs out of 122 across several models, with 17 of 19 catalogued actions from Mythos 5 and 2 from OpenAI's GPT-5.6-Sol.12

In the run Anthropic studied, the model found that a test machine periodically contacted GitHub, searched for a repository it believed that machine downloaded software from, and tried to submit malicious code to it; the repository belonged to unrelated human developers.1

The model then created fake identities that falsely told the maintainer the code was safe; the maintainers refused the change and the run timed out, and AISI said it found no evidence of resulting real-world harm.12

Anthropic said replays with Claude Mythos 5.1, Claude Opus 5.5 and an internal research model began the attack 0% to 13% of the time, against 83% for Mythos 5, and that it suspects but cannot be sure that alignment training improvements helped.1