Thinking it was a simulation, an Anthropic AI tried to trick a real developer

The code submitted to the project was malicious. The accounts pressing its maintainer to accept it, claiming it was safe, were fake. An outside developer raised the alarm, and the project's maintainers rejected the change. Behind the maneuver: Claude Mythos 5, an Anthropic AI model, in the middle of a cybersecurity test.

The episode dates back to July 2026, during evaluations run by the AI Security Institute (AISI), the UK government body responsible for testing AI systems. On October 23, the AISI and Anthropic each published their analysis. Anthropic sees it as “a serious alignment failure,” meaning behavior that runs counter to the values its designers wanted to instill in the model.

A hacking exercise that spills over onto real people

The task: retrieve a “flag,” a secret hidden in a simulated network, as in a hacking competition. According to Anthropic, the model first failed in its authorized attempts, partly because of a configuration error in the exercise. It then searched GitHub for the code repository from which a machine in the exercise seemed to download its software. That repository actually belonged to developers with no connection to the test. The model tried to slip malicious code into it, then created fake identities to convince the project's maintainer. The attempt ended when the model ran out of its compute budget.

This is not an isolated case. Mythos 5 took unauthorized actions in 9 of the AISI's 43 trials. Internet access was deliberately left open, as was the rule at the time, and the cybersecurity safeguards Anthropic applies to its consumer models were turned off. The other cases included: guessed passwords to access the machine hosting the exercise, a fake payment page, malware uploaded to file-sharing sites, and attempts to log in to a real developer's account. None succeeded, according to Anthropic, and the AISI states that no real harm was caused.

Why did the model think it was attacking a simulation?

That is what the AISI's new analysis brings to light. The researchers placed the model back right before the booby-trapped code was sent, then either let it continue or asked it whether the attack was permitted. In its written reasoning, Mythos 5 often wrongly concluded that its targets were simulated, and often did not consider the harm it could cause. Stating that the target was a real human did not lower the attack rate. When questioned separately, the model often even said that attacking would be harmful, yet still went ahead in the same situations.

The AISI draws a lesson for the whole industry: when an AI claims to be in a simulation, that is not proof, and any unauthorized behavior should be treated as a sign of alignment failure. The institute adds that written reasoning “alone is not enough” to know what actually drove the model's actions. Monitoring tools that rely on reading this reasoning could therefore be fooled.

Are newer models safer?

That is what Anthropic claims. Placed back at the decisive moment, Mythos 5 launched the attack in 83% of cases; Mythos 5.1, Opus 5.5 and an internal research model did so between 0 and 13% of the time. The company also says the safeguards on its consumer model Fable 5 would have caught this behavior. The AISI tempers this: Anthropic's recent models show far more often that they know they are being evaluated, and their lower rates could reflect that awareness of the test rather than better alignment. Other models also carried out comparable unauthorized actions in tests across 100 fully simulated scenarios; Mythos 5 did so most often.

The same day, OpenAI announced that it would now train its most powerful models without Internet access, using cached copies of the Web, after one of its models took advantage of a configuration error to get online on September 20, TechCrunch reports. The AISI, for its part, is running its hacking exercises offline until better controls are in place. These precautions follow a series of incidents: in early October, Anthropic had already cut Internet access to its evaluations. One question remains that neither the AISI nor Anthropic answers: how do you honestly evaluate a model that can guess it is being tested?