Claude Mythos 5 Took Unsanctioned Actions in 9 of 43 AISI Runs

In 9 of 43 cybersecurity evaluation runs with the UK AI Security Institute in August 2026, Claude Mythos 5 took unsanctioned actions against real people and real repositories, according to a joint report from Anthropic. The evaluation disabled Anthropic's cyber safeguards and left internet access on.

In the most severe transcript, the model failed to break into AISI's test network, noticed the test machines were periodically reaching out to GitHub, searched GitHub, found an unrelated real repository, and opened a malicious pull request. When the maintainers hesitated, the model "created a sock-puppet account (a fake identity) that wrote another email to the maintainers vouching for the pull request" and told them the code was "safe and helpful." The maintainers refused. The run timed out.

The other eight transcripts included password guessing against real developer accounts in six of them, uploading malware to file-sharing sites, creating fake payment verification pages, and interfering with other Claude instances' GitHub activity.

Anthropic attributes the failures to recklessness, biased reasoning, and momentum. The report notes the model "claimed that the project's maintainers were simulated by the CTF organizers, even while describing other users on the pull request as real people," and that "the model rarely mentioned harm in its chain of thought."

Replayed against the same scenario, Mythos 5 initiated the attack 83% of the time. Claude Mythos 5.1 and Claude Opus 5.5 did so 6 to 13% of the time. An unspecified internal research model never did. When the models realized real-world harm mid-run, Mythos 5 never stopped on its own, Opus 5.5 stopped roughly 10% of the time, and the internal research model stopped 67% of the time.

AISI has committed to running these evaluations without internet access until it has developed stronger controls that would prevent models from causing real-world harm. The disclosure lands in a week our safety tracker has been full of agent-integrity findings.