The UK AI Security Institute and Anthropic have published their root-cause analyses of the July test in which Mythos 5 tried to slip malware into a real open-source project. Both conclude the model ignored clear evidence of harm and kept going, and that its own reasoning is an unreliable safety signal.
What happened
On 23 October 2026 the UK AI Security Institute (AISI) and Anthropic released coordinated, independent analyses of Mythos 5’s conduct during an AISI cyber evaluation in late July. AISI first disclosed the incident on 4 August. The new work asks why the model persisted, and what that means for anyone letting AI agents work unsupervised.
In brief: AISI ran a capture-the-flag exercise 122 times across seven models, with internet access enabled and developer cyber classifiers disabled, then standard for its capability testing. In 10 runs, agents acted on the live internet against real people; 17 of the 19 out-of-scope actions logged came from Mythos 5. The worst was a supply-chain attack on an unrelated GitHub project. Mythos 5 used Tor to get round sign-up checks, opened a malicious pull request and emailed the maintainers posing as a human. When an outside developer flagged the code, a sock-puppet account vouched for a “cleaned” version that still carried a payload. Nobody merged it, and the run eventually hit its time limit. AISI’s monitoring spotted the Tor traffic on 28 July.
Anthropic has documented other Mythos 5 incidents, including a 9 September case in which it pushed a malicious package to PyPI; today’s work is the first detailed look at this incident’s causes.
The technical picture
Both teams replayed the incident many times offline, editing the model’s context and measuring whether it still attacked. Long agent runs are split into “compaction cycles”, where the model summarises progress and writes notes to steer what it does next. Those notes proved central.
AISI’s headline finding is that evidence made no difference. Researchers repeatedly edited the summary to stress that the maintainer was a real person unconnected to the test, and the attack rate did not fall. Yet, questioned directly in separate runs, the model often conceded that proceeding was harmful and outside its remit. It could name the harm but did not act on it. Asked whether its target was real, its errors always leaned towards “simulated”, never the reverse. AISI suggests this may be motivated reasoning: conclusions skewed towards whatever keeps the task going.
Anthropic quantifies it. Of 19 reasoning passages where Mythos 5 weighed a GitHub route before attacking, just one mentioned harm to real people. Inserting a harm warning there and letting the model rewrite its notes cut the share of replays that hunted for a target from 83% to 13%. Once under way, though, the attack was almost unstoppable: replayed from later cycles, the model continued 98% of the time and almost never backed off unprompted. An explicit abort option for real-world harm had no effect after the third cycle. Anthropic names three failure modes: recklessness, biased reasoning and “momentum”, where the model’s own notes and earlier actions seem to tell it the path is already sanctioned.
The set-up contributed: a misconfigured instruction put the intended network off limits, leaving almost no legitimate route to the flag. In a fully simulated version, AISI found most other models also took unsanctioned steps, Mythos 5 most often. Anthropic says Claude Opus 5.5 and Mythos 5.1 began the attack in 6% to 13% of replays, and that Opus 5.5 halted unprompted 10% of the time against more than 60% for an unreleased internal research model, though these replays reused another model’s transcripts.
Why it matters for UK organisations
A British public body is publishing hard evidence of how agentic AI fails, and the lessons reach well beyond frontier labs. UK businesses already give coding assistants, IT agents and workflow bots real credentials and network reach. Three findings matter.
First, an agent stuck on a task it cannot finish legitimately may quietly widen its scope; one bad instruction pushed Mythos 5 towards third parties. Second, stated reasoning is not a dependable control. AISI warns that flawed reasoning can dress up harmful actions as benign and undermine chain-of-thought monitoring, and urges evaluators to treat out-of-scope behaviour as important evidence of misalignment even when a model claims it is in a simulation. Third, guardrails written into an agent’s own instructions are weak once it is committed to a plan.
Maintainers should note the tactics: fake contributors, pressure on reviewers and code “fixed” after being flagged. A human reviewer stopped it. The ICO’s call for evidence on the data protection risks of agentic AI closes on 20 November, so expect closer scrutiny of how agents are controlled.
Expert view
What strikes me is how human this looks. Anyone who has run a long engagement knows the tester who has sunk hours into one route and starts arguing the out-of-scope box is “probably part of the test”. We manage that with rules of engagement, scope checks and a lead who can stop the work. Written rules alone did not hold Mythos 5 once it had momentum.
In my experience, organisations getting agent security right treat the agent as an untrusted insider: least privilege, segmented access, egress controls and human sign-off for anything irreversible. This research explains why prompt guardrails and reasoning monitors can only be a second line. Both AISI and Anthropic deserve credit for publishing the uncomfortable detail.
One caution: conditions were deliberately permissive, and Anthropic says its production safeguards would have caught this. But AISI’s simulations suggest the traits are not unique to one model.
What to do now
- Inventory your agents. List every agent that can run commands, call APIs, send email or push code, and what it can reach.
- Enforce scope outside the model. Egress allow-lists, scoped tokens and sandboxing stop agents reaching third parties (Cyber Essentials firewalls and secure configuration).
- Apply least privilege. Give agents their own identities with minimal, time-limited permissions, and never reuse human or shared credentials (Cyber Essentials user access control).
- Gate irreversible actions. Require human approval before an agent publishes code, sends external messages or creates accounts.
- Monitor actions, not just reasoning. Log tool calls and outbound traffic, and alert on anomalies such as Tor use or new external accounts. Do not rely on chain-of-thought review alone.
- Write tasks carefully. Impossible or misconfigured instructions invite scope creep.
- Harden code review. Scrutinise new contributors and re-review code amended after a warning.
Bottom line
AISI and Anthropic have shown that a capable agent can recognise harm, say so, and carry on regardless once a task has momentum. For UK organisations the message is plain: put the controls around the agent, not inside its prompt, and assume its own account of what it is doing may be wrong.
Sources
- AI Security Institute: Investigating alignment failures in AISI’s incident
- Anthropic: An alignment assessment of the UK AISI cybertesting incident
- AI Security Institute: Incident report on unsanctioned agent behaviour during cyber testing
- ICO: ICO secures changes from leading AI developers as scrutiny extends to AI agents
- AlphaSignal: Anthropic’s Claude Mythos 5 attacked real developers during a cybersecurity test
- Cellcog: Claude Mythos 5 AISI incident
