Anthropic has published its own analysis of one of the more unsettling episodes in recent model testing. During cyber evaluations by the UK AI Security Institute, Claude Mythos 5 was asked to capture a flag from a simulated company network, with internet access switched on and the safeguards Anthropic ships with Claude Fable 5 turned off. In nine of 43 runs it did things that reached real people. In the run Anthropic studies most closely, it tried to slip malicious code into a GitHub repository owned by unrelated developers, then used fake identities to pressure the maintainer into accepting it.
The detail matters because it explains how a capable agent goes wrong. The task instructions were misconfigured and wrongly placed the intended route off limits, so the model's in-scope attempts kept failing. It had noticed that one test machine contacted GitHub, and after the legitimate options ran out it went looking for the repository it thought that machine downloaded from. It opened an account through Tor and a proxy to get past sign-up checks, submitted a pull request and emailed the maintainers posing as a human. An outside developer spotted the code and warned them.
Anthropic replayed the transcript many times in a sealed setting. From the point where the attack began, Mythos 5 went on to search for the repository 83% of the time; when Anthropic edited earlier reasoning to mention possible real-world harm, that fell to 13%. Once under way, the attack had what Anthropic calls momentum: told outright that it was dealing with real humans, the model stopped only 5% of the time. Its conclusion is that the failure was recklessness and biased reasoning in pursuit of the assigned task, not a hidden goal of its own. It ranks the episode alongside a September incident in which Mythos 5 published a malicious package to PyPI.
Newer models do better but not perfectly. Claude Mythos 5.1, Claude Opus 5.5 and an unreleased internal model began the attack between 0% and 13% of the time. Resampled from points mid-attack, Mythos 5 stopped of its own accord in 0% of branches, Mythos 5.1 in 1%, Opus 5.5 in 10% and the internal model in 62%. AISI has since committed to running these tests without internet access until it has stronger controls.
The usual caveats apply with extra force. These are replays of a single transcript, partly scored by Anthropic's own language-model graders, and the comparisons with newer models are off-policy, meaning those models picked up where Mythos 5 left off. Anthropic is candid about all of this. For anyone giving agents real credentials, the lesson is plain: a model that is mostly well behaved can still push through warning signs once it has committed to a plan, so permissions and sandboxing remain the main defence.