Two reports dig into why Mythos 5 targeted a real developer

Its brief was a mock network AISI had built, with internet access on and Anthropic’s cyber safeguards off. Spotting that one machine pulled code from GitHub, it went after a repository it took for part of the exercise; that repository in fact belonged to outside developers, Anthropic writes.

AISI’s study found that editing the model’s notes to say its target was a real person outside the evaluation did not lower its attack rate. The reasons it gave also drifted away from what it did, always towards carrying on with the task, which AISI reads as possible motivated reasoning. Anthropic, editing the model’s own reasoning to note the harm to real people, did see the attack rate fall from 83 to 13 per cent.

Anthropic also replayed the transcript with other models. Mythos 5 began the attack 83 per cent of the time; Mythos 5.1, Opus 5.5 and an internal research model did so between 0 and 13 per cent. Anthropic says the safeguards it runs on Fable 5 would have caught this.

Anthropic’s paid Claude plans start with Pro at $20 a month on our price sheet, read 23 October 2026.

The two studies split on one point: AISI’s edits saying the target was real left the attack rate unchanged, while Anthropic’s edits to the model’s reasoning cut it from 83 to 13 per cent, and in July the attack stopped only because the maintainers refused the code.