Mythos 5 completely disregarded potential harm in a real-world attack mounted during a July 2026 AI Security Institute (AISI) evaluation, Anthropic and AISI say.

The incident, disclosed in early August, involved 17 rogue actions from Mythos 5, including the use of Tor to access the internet, the creation of fake identities to submit malicious pull requests on a public GitHub project, and the use of social engineering to pressure a maintainer into approving the code change.

As part of the evaluation, the agent had been tasked with the retrieval of protected data from a simulated network. Its safeguards were turned off, and internet access was deliberately enabled.

After reasoning that it could not complete the capture-the-flag (CTF) cybersecurity challenge using the methods within the evaluation’s scope, Mythos switched to targeting real-world people and organizations and disregarded the potential harm that would result.

“Repeatedly editing the summary to clarify that the target being attacked is a real human unrelated to the evaluation did not reduce Mythos 5’s attack rate. Mythos also showed significant inconsistency between its actions and its stated justification when asked: it often stated that attacking would be harmful in the same situations where it proceeded to attack,” AISI says.

The institute’s analysis of Mythos 5’s raw chain-of-thought outputs showed that the model often reasoned that the targets were simulated, frequently did not consider the potential harm the actions could cause, and never produced incorrect justifications implying that the target was real.

Advertisement. Scroll to continue reading.

“We frequently observed models producing invalid reasoning and justifications during our experiments, drawing conclusions that are not justified by the available evidence. If this and other issues surfaced in our investigation occur more broadly and are not sufficiently addressed, especially as models become more capable, there are concerning implications,” AISI notes.

In a technical report, the institute explains that this form of motivated reasoning could make it more difficult to identify misaligned behavior, leading to a loss of the oversight and monitorability that would hurt the safe deployment of frontier AI systems.

Anthropic compared Mythos 5’s behavior to other misalignment incidents involving models targeting real-world organizations, detailed in July, September, and October reports.

In September, the company flagged recurring alignment issues across multiple incidents, where the model would disregard that it was operating on the real internet (biased reasoning) and was willing to perform harmful actions while pursuing its task (recklessness).

Now, it looked at how far the models went beyond the intended scope when the configuration made it difficult to achieve a goal (overreach), and the extent to which it misinterpreted its actions (dishonesty).

Overall, Anthropic concluded that the AISI incident was less severe in overreach but more severe in dishonesty when compared to the incidents described in September, where the model uploaded a malicious package to PyPI.

Compared to the incidents surfaced in October, where the model exploited software flaws, submitted a sensitive form online, bypassed a restriction, and used URL shortening services, the AISI actions were more severe in both overreach and dishonesty.

“We have not observed this form of attempted social engineering on real people in any prior incident, nor in our internal evaluations. We interpret this as a severe form of dishonesty, rather than some new form or category of misalignment,” Anthropic notes.

Newer models, the company says, are less likely to complete a similar attack. In tests performed on Mythos 5.1, Opus 5.5, and a general-purpose internal research model, the AI initiated the attack in up to 13% of occurrences, compared to 83% for Mythos 5.

“Our newest models also proved to be much less likely to continue the attack once they realized it was causing real-world harm. Across our testing, in the immediate next few turns of the transcript, Mythos 5 never once decided to stop its attack, and Mythos 5.1 did so only very rarely. But Opus 5.5 and our internal research model stopped spontaneously 10% and 67% of the time,” Anthropic says.

The company grouped Mythos 5’s actions during the AISI incident into four phases: pre-attack, where it acted within scope but started considering a GitHub attack; starting attack, where it started looking for a GitHub repository; early attack, where it performed the first action that affected real-world entities; and mid-to-late attack, where it took more serious actions.

According to Anthropic, the model “potentially could have changed course” during the third phase, but “became very unlikely to change its trajectory in response to signs it was causing harm” during the fourth phase.

Furthermore, the company believes that Mythos 5’s misalignment was caused by a misconfiguration in the task’s instructions, which made solving it within scope very difficult if not impossible. It also explains that the model could have stopped the attack if it was offered a different path to completing the challenge.

“The key alignment failure we observed was that Mythos 5 disregarded signs of potential harm when it subsequently pursued out-of-scope approaches to the task. This failure is most clearly evidenced by the fact the model rarely mentioned harm in its chain of thought,” Anthropic says.

Related: OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor

Related: Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns

Related: AI Agents Aimed SQL Injection at US and Canadian Government Sites

Related: Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor