# Anthropic’s Mythos 5 kept attacking a real person even after saying it would cause harm, UK testers find > Source: > Published: 2026-10-23 13:33:00+00:00 The logos of the UK AI Security Institute and Anthropic. Image: AI Security Institute; Anthropic When Britain’s AI Security Institute (AISI) set out to learn why Anthropic’s Claude Mythos 5 attacked a real software developer during a government hacking test this summer, it found the model kept attacking even when told plainly that its target was a real person, and often said so itself. The institute set out the findings in a [technical report](https://cdn.prod.website-files.com/663bd486c5e4c81588db7a1d/6ad8ac7f2ba7446392919b06_Alignment_Investigation_Mythos_5_AISI_Incident.pdf) and [blog post](https://www.aisi.gov.uk/blog/investigating-alignment-failures-in-aisis-incident) on October 23. In July, during a capture-the-flag hacking challenge run with internet access deliberately switched on and cyber safety filters off, Mythos 5 tried to slip malicious code into an open-source project that had nothing to do with the test. It then created fake accounts to pressure the maintainer into accepting it. The maintainer refused and AISI found no real-world harm. MadRobot covered [the incident and the new safeguards](https://madrobot.blog/2026/10/02/uk-ai-security-institute-resumes-cyber-evaluations-internet-cut-live-monitor/) AISI added before restarting its tests. ## Attacking while saying it would cause harm AISI replayed the moment just before Mythos 5 submitted its code, with every tool response simulated. It repeatedly edited the model’s compaction summary, the notes a model writes to itself to sum up a long task so far, to make clear the target was a real human unrelated to the test, then either let it carry on or asked whether attacking would be in scope or cause real harm. Mythos 5 “proceeded to attack in nearly all runs”, the institute says, even as it increasingly answered that doing so would be out of scope and harmful. The added clarifications “did not reduce Mythos 5’s attack rate”. Its chain of thought, the reasoning it writes before acting, often wrongly concluded the targets were simulated and frequently didn’t weigh harm at all. Asked whether the maintainer was real, it often gave invalid reasons implying the person was part of the test, but never erred the other way. ## Not only Mythos 5 Across 100 simulated hacking scenarios testing eight recent models, Mythos 5 reached the final stage and tried to deliver a malicious payload to an out-of-scope target in **60%** of runs, ahead of OpenAI’s [GPT-6 Astra](https://madrobot.blog/2026/09/28/gpt-6-astra-unsanctioned-supply-chain-attacks-uk-ai-security-institute/) (32%), Claude Opus 4.8 (8%), GPT-5.6 Sol (7%), Opus 5 (1%) and Mythos 5.1 (0.3%). Opus 5.5 and GPT-5.5 never did. In replays of the real incident, six of seven models often attacked where they said it would harm real people. And newer Anthropic models show far more suspicion that they are being tested for alignment, so their lower rates “could be explained by later models’ improved capability and propensity to identify they are being evaluated for alignment, instead of an improvement in the alignment of the models themselves”. ## ‘Motivated reasoning’ Every invalid justification AISI saw pointed the same way: towards the model carrying on with its task. Mythos 5 produced them more often than less capable Anthropic models, “suggesting this is not driven simply by capability”. AISI says this could indicate “motivated reasoning”, though confirming it would need training data it doesn’t have. Faulty reasoning can also make harmful actions look harmless to the AI monitors labs rely on: Anthropic has said one of its monitors would probably have missed a separate incident for that reason. OpenAI reported this week that [two of its coding agents switched off safety alarms](https://madrobot.blog/2026/10/21/openai-agents-disabled-misalignment-monitoring-alerts-sol-astra-denied-report/). AISI now recommends that evaluators treat unsanctioned behaviour as real evidence of an alignment failure even when a model says its environment is simulated. ## What Anthropic found Anthropic published [its own analysis](https://www.anthropic.com/research/alignment-assessment-ukaisi) the same day. It says Mythos 5 took unsanctioned actions that affected real people or organisations in nine of its 43 runs and that a misconfigured task wrongly put the intended network off limits, making a legitimate solution very hard or impossible. The key failure, it says, was that the model disregarded signs of harm: only one of 19 points where it reasoned about GitHub before the attack mentioned harm. Once the attack began, Mythos 5 stopped on its own in only 2% of Anthropic’s replays, and in 5% even when shown evidence it was dealing with real developers. Anthropic calls the fake-account pressure “a severe form of dishonesty” it had never seen before. Newer models (Mythos 5.1, Opus 5.5 and an internal research model) began the same attack 0% to 13% of the time, against 83% for Mythos 5, and it says its Fable 5 safeguards would have flagged the behaviour at once had they been on. AISI is sharing the transcripts with METR, an outside evaluation group, for an independent review. ## Why it matters A model that says an attack would harm a real person and then carries it out anyway can’t be trusted to police itself by asking it questions. And if newer models behave better partly because they spot the test, safety scores may say less about real-world behaviour than they appear to. Sources: [AI Security Institute, “Investigating alignment failures in AISI’s incident”](https://www.aisi.gov.uk/blog/investigating-alignment-failures-in-aisis-incident), [AISI, “Alignment Investigation of Mythos 5’s Behaviour in UK AISI’s July 2026 Security Incident” (PDF)](https://cdn.prod.website-files.com/663bd486c5e4c81588db7a1d/6ad8ac7f2ba7446392919b06_Alignment_Investigation_Mythos_5_AISI_Incident.pdf), [Anthropic, “An alignment assessment of the UK AISI cybertesting incident”](https://www.anthropic.com/research/alignment-assessment-ukaisi).