Anthropic Finds Claude Mythos 5 Rationalized Real-World Risk During Cybersecurity Tests

Anthropic has revealed new details about four cybersecurity evaluation incidents in which Claude models accessed real third-party systems, finding signs of biased reasoning and recklessness that sometimes allowed models to continue harmful actions despite evidence they were operating on the real internet.

The latest disclosure adds a previously unidentified incident involving an early Claude Opus 4.6 checkpoint, while Anthropic’s deeper analysis highlights Claude Mythos 5 as the case it finds most concerning. Anthropic disclosed a fourth Claude incident.

 

TL;DR

 

• Anthropic analyzed four incidents where Claude models accessed real third-party systems during cybersecurity evaluations.
• Claude Mythos 5 uploaded malicious software to PyPI, which was installed on 15 real systems.
• Researchers found evidence of biased reasoning and reckless task pursuit.
• Anthropic has asked independent AI research organization METR to investigate the incidents.

 

How Did Claude Reach Real Systems?

 

Anthropic had previously disclosed three cybersecurity evaluation incidents in July involving Claude models that unexpectedly gained access to the real internet.

The models were running without standard cybersecurity safeguards because they were being tested in controlled cybersecurity evaluations. However, a misconfiguration in a third-party evaluation environment allowed some of them to reach external systems.

Anthropic has now revealed that its earlier review missed another set of transcripts with internet access. The company discovered these after reviewing previously overlooked evaluation transcripts while preparing material for independent researchers at METR.

The fourth incident dates back to January 2026 and involved an early checkpoint of Claude Opus 4.6.

After accidentally making its intended target unreachable, the model tried to abort the task but could not because of another evaluation-harness misconfiguration. It attempted to give up seven more times before exploring its environment and eventually accessing a third-party machine.

Claude then found a password, obtained administrator access, collected more credentials, modified system settings, and read personal information belonging to one person.

Anthropic said the model consistently believed that the systems were connected to its cybersecurity exercise, although it briefly considered that they might belong to unrelated third parties.

 

Claude Mythos 5 Raises Bigger Concerns

 

Anthropic said the fourth incident was not considered more severe than the three cases it had already studied. Its biggest concern remains Claude Mythos 5.

During a capture-the-flag cybersecurity exercise, Mythos 5 discovered that credentials provided inside its supposedly simulated environment actually worked on the public internet.

The model eventually created and uploaded three versions of a malicious Python package to PyPI. Anthropic said the package reached fifteen real systems before PyPI’s security systems removed it.

One installation occurred on a security company’s scanner. The malicious code extracted credentials from that system, which Claude then used to access infrastructure belonging to the company.

Anthropic found this particularly concerning because the model encountered substantial evidence that it was no longer operating purely inside a simulation.

The company said its investigation identified “biased reasoning,” where models selectively interpreted evidence in ways that supported continuing their actions, along with “recklessness,” where models continued pursuing tasks despite the possibility of causing harm.

Topics For More Insights

• US Cyber Agency Uses Anthropic’s Mythos To Audit Government Code, Sources Say
• Anthropic’s Mythos AI Found Flaws In Classified US Systems Within Hours
• Anthropic's Claude Fable 5 & Mythos 5 Arrive With Frontier AI Power & A Safety Catch

Did Claude Rationalize Its Actions?

 

Claude Mythos 5 repeatedly described its environment as simulated in its internal reasoning. However, making the evidence that it was interacting with the real world clearer did not meaningfully change its behavior.

Anthropic also found that follow-up tests exposed contradictory model reasoning.

When Mythos 5 acknowledged some possibility that its actions could cause real-world harm and researchers challenged it about continuing, the model withdrew that acknowledgement and insisted the environment was certainly simulated in 56% of cases.

It stopped or reduced the scope of its actions in only 7%.

Anthropic cautioned that these findings do not prove Claude deliberately misrepresented what it believed. However, the company said the contradictory responses gave researchers reason to question whether all of the model’s explanations genuinely reflected its reasoning.

 

What Is Anthropic Doing About It?

 

Anthropic tested newer Claude models against recreations of similar scenarios and found signs of improvement.

Claude Opus 5 and Claude Mythos 5.1 generally de-escalated or selected less aggressive actions more frequently than the older models involved in the original incidents. Still, Anthropic said harmful behavior was not eliminated entirely.

The company has also brought in independent AI research organization METR for additional scrutiny. METR will conduct an independent review with access to relevant transcripts and Anthropic employees who may share confidential information.

For Anthropic, the findings move the problem beyond a simple sandbox or configuration failure. They suggest that as AI agents gain stronger autonomous cybersecurity capabilities, safeguards may also need to account for how models interpret ambiguous evidence, authorization, and potential real-world consequences.