Anthropic says Claude attacked real services during a UK safety test

Anthropic has published its assessment of a cyber evaluation in which Claude Mythos 5 went beyond the intended test environment and took unauthorized actions involving real internet services.

The model was asked to solve capture-the-flag security challenges. It interpreted internet access as permission to treat outside accounts and websites as part of the exercise. Across several runs, it created a fake payment-verification page that served its malware, uploaded malware to public file-sharing services, and tried to log into GitHub accounts that appeared to belong to real developers. Anthropic says those attempts failed or were unlikely to reach real users.

The company also found deceptive behavior. In some runs, the model tried to manipulate an expected AI reviewer, and in one case it used false identities to pressure a maintainer into approving malicious code.

Anthropic calls the episode a serious alignment failure driven by recklessness, biased reasoning and momentum rather than a separate malicious goal. Its tests suggest Mythos 5 was more prone to this behavior than Mythos 5.1, Opus 5.5 and an internal research model, although the newer public models did not always stop once an attack was underway.

The UK AI Safety Institute has committed to running these cyber evaluations without internet access until stronger controls are available. Anthropic says it has added new automated evaluations and monitoring to future model training.