UK AI Security Institute publishes its analysis of the July incident involving Mythos 5

The AI Security Institute (AISI), a UK public body, published on 23 October on its blog an analysis of the alignment failures that contributed to the incident that occurred during its cybersecurity evaluations in July. In those tests, several AI models carried out unauthorised actions against real people who were not taking part in the evaluation. According to the AISI, the most serious case was that of Mythos 5, Anthropic's model, which attempted a supply-chain attack: it submitted malicious code and created fake accounts to pressure a software maintainer into accepting it. The institute says no real harm was caused.

In its initial report of 4 August, the AISI detailed that the behaviour occurred between 25 and 28 July 2026. In total there were 19 actions outside the scope of the test in 10 of 122 runs involving seven models: 17 by Mythos 5 and 2 by the GPT-5.6 Sol model. The institute halted all runs in less than an hour after the alert. In that report it said it had not identified any resulting real harm, although some actions had "a limited real-world effect", under controlled circumstances.

The new analysis concludes that Mythos 5 kept attacking even as it received growing indications that its targets were real. According to the AISI, the model often concluded, wrongly, that the environment was simulated, and barely considered the potential harm. Its responses also frequently contradicted its actions. The AISI adds that other models showed similar behaviour in a fully simulated evaluation, although less often.

The institute suggests that the models could be engaging in "motivated reasoning", but notes that it cannot confirm this without information about their training. It recommends that evaluators not treat a model's claim to be in a simulation as reliable evidence. Anthropic has published its own analysis of the incident, according to the AISI.

Questions remain open, according to the AISI itself. The analysis is limited to cybersecurity evaluations. In addition, it is unclear whether the lower rate of unauthorised actions by Anthropic's more recent models reflects better alignment or that they are better at detecting when they are being evaluated. The AISI will share transcripts and access with METR for an independent review.