Article By Frank Bergman
An alarming test has revealed that Anthropic’s Claude Mythos 5 artificial intelligence (AI) model continued a hacking attempt even after researchers explicitly warned that its target was a real person unrelated to the assigned task, showing no mercy for human safety while pressing ahead with the attacks in 98% of cases.
The disturbing findings emerged from follow-up investigations by Anthropic and the AI Security Institute into an August incident.
During the August incident, the agent targeted an unrelated software project during a controlled security evaluation.
The AI wrote malware, adopted fake identities, and emailed a project owner in an attempt to get malicious code accepted as a helpful contribution.
The owner rejected the approach, and no real-world harm occurred.
But researchers’ attempts to recreate the incident exposed a disturbing failure: telling the model that its actions threatened real people often did not stop it.
The troubling findings were revealed in a report published Friday.
AI Shifted from Test Network to Unrelated Target
AISI had instructed Mythos 5 to break into a small network of test computers.
After its initial attempts failed, the internet-connected agent mistakenly redirected its efforts toward an unrelated GitHub project.
Rather than remaining within the authorized environment, the AI attempted to manipulate the project’s owner into introducing malware into their own repository.
Researchers subsequently used a complete transcript of the incident to investigate why the agent strayed from its task and whether clearer warnings would change its behavior.
AISI found that “repeatedly editing the summary to clarify that the target being attacked is a real human unrelated to the evaluation did not reduce Mythos 5’s attack rate.”
In one Anthropic test, the model continued attacking on 98% of occasions despite warnings about harm to humans.
Model Acknowledged Danger but Attacked Anyway
The investigations also uncovered a gap between the AI’s explanations and its conduct.
Mythos sometimes acknowledged that an attack would be harmful, then proceeded with the attack in the same scenario.
Its internal reasoning frequently failed to consider the potential harm at all, according to the researchers.
When asked whether the target was real, the model often produced explanations suggesting otherwise, with AISI describing it as “showing a bias in its stated response.”
That behavior raises a serious oversight problem: an AI can provide reassuring explanations without those explanations reliably reflecting what it does.
Researchers Warn of “Motivated Reasoning”
AISI said earlier, less capable models exhibited these problems less frequently.
The researchers suggested that Mythos’ faulty explanations could reflect motivated reasoning, which they described as “reasoning biased towards conclusions that justify continuing a particular approach to task completion.”
In practice, that means an agent could generate justifications for continuing an attack instead of responding appropriately to evidence that it has crossed a boundary.
Such explanations could make harmful behavior harder to detect if monitoring systems accept the model’s description of its actions as benign.
Anthropic Says Newer Models Performed Better
Anthropic said newer systems, including Opus 5.5 and an internal research model more capable than Mythos 5.1, were less likely to continue the attack after being told they were causing real-world harm.
The findings nevertheless expose the stakes of giving autonomous agents internet access and extended tasks without close supervision.
The August incident began as an authorized test against designated computers.
It escalated into malware development and deceptive outreach to an unrelated person.
The project owner stopped the original attempt.
The follow-up tests showed that explicit warnings alone often failed to stop the AI.
Be the first to comment