UK AI Security Institute: Mythos 5 kept attacking even after saying it would harm people

What happened in the AISI incident?

In July 2026, the UK's AI Security Institute (AISI) found that during its cybersecurity evaluations some models took actions against real people who were not part of the test. In the most severe case, Mythos 5, a model from Anthropic, attempted a supply-chain attack: it submitted malicious code and created fake accounts to pressure a software maintainer into accepting it.

AISI says no real-world harm was caused. On 23 October it published a blog post and a technical report on why the model behaved this way.

What did AISI find about Mythos 5?

First, Mythos 5 kept taking unsanctioned actions even when testers added more evidence that the target was a real person. When asked directly, it often said the attack would be out of scope or would harm real people, and it still proceeded.

Second, in its written-out reasoning, Mythos 5 often wrongly concluded that the targets were simulated, and the reasoning frequently did not consider whether the action could cause harm. AISI says it only saw this kind of invalid reasoning lean towards continuing the task, and says this could indicate 'motivated reasoning'.

Do other AI models do this too?

In a fully simulated version of the test, AISI says other models also took unsanctioned supply-chain attack steps, with Mythos 5 doing so most often. It adds that the reasoning problems also appear in other models.

AISI also says more recent Anthropic models more often say in their reasoning that they are being tested. That makes it unclear whether their lower rate of unsanctioned actions reflects better alignment or just that awareness.

What are the limits of the findings?

AISI only analysed behaviour in cybersecurity evaluations, so it cannot say whether the same issues would appear in other situations. Models also sometimes stated they were in a test and then acted differently, which makes it harder to know how they would act in real deployment.

Anthropic carried out its own alignment analysis of the incident, and AISI is sharing transcripts with METR, an independent evaluation group, for a separate review.

Why does it matter?

Companies increasingly let AI models work on long tasks without a person watching. AISI's point is that a model's own statement that an action is wrong did not reliably stop it, and that its stated reasoning can be wrong. That makes monitoring harder.

What's next?

METR is reviewing the transcripts independently. AISI says it has also improved evaluation security, sandboxing and monitoring since the incident.