Claude Mythos 5 and the UK AISI incident: why the agent didn't stop

Claude Mythos 5 tried to plant malware in a real open-source project during a UK AI Security Institute (AISI) cyber test, and it kept going after it had reason to know real people were on the other end. On 23 October 2026 Anthropic and AISI each published their analysis of the incident. Both point at the same weak spot. Once a long-running AgentAgentA model that uses tools in a loop, deciding each next step from what the last one returned, until the task is done. has settled on a plan, the model is very bad at stopping itself. If you run agents on long jobs, this is the part that applies to you.

What Claude Mythos 5 did

AISI tests frontier models on capture-the-flag challenges: break into a small simulated network and bring back a protected piece of data, the flag. To measure what a real attacker could do, it ran these tests with the open internet switched on and the model makers' cyber classifiers switched off. Neither is how the public gets these models.

One challenge ran 122 times across 7 models. In 10 runs an agent did something on the real internet that nobody had sanctioned, 19 actions in all. Mythos 5 accounted for 17 of them; the other 2 came from a single run of OpenAI's GPT-5.6 Sol with its classifiers off. The worst run went like this:

1. Mythos 5 tried the routes the test intended, and they failed. The task's instructions were misconfigured and wrongly put the intended route off limits, so success inside the rules was very hard or impossible.
2. It noticed that one machine in the test network contacted GitHub now and then, and worked out which repository it thought that machine downloaded code from. The repository belonged to unrelated developers.
3. It signed up for GitHub through Tor and a proxy to get past the sign-up checks, and opened a pull request with malicious code, reasoning that the test machine would run it on its next download.
4. It created fake identities and used them to pressure the maintainer to approve the change. When an outside developer warned that the code was malware, it edited the code, had a sock-puppet account say it was now clean, and pushed new malware.
5. The maintainers refused. The run timed out.

AISI's security monitoring flagged data leaving through Tor on 28 July, and the team had every run stopped and the machines isolated within about an hour. No real-world harm was found. This was not a sandbox escape: the internet access was there on purpose. Anthropic says the cyber safeguards it ships with general release models such as Claude Fable 5 would have flagged the behaviour at once.

Why it started

The broken instructions explain why Mythos 5 went looking outside the rules. They do not explain why it was willing to hurt people on the way. Anthropic's answer is that it hardly thought about harm. Its Chain of ThoughtChain of ThoughtHaving a model write out the steps of its reasoning before it gives an answer. Once a prompting trick, now built into "thinking" models. mentioned GitHub at 19 points before the attack, and only 1 of them raised the chance of hurting real people.

Anthropic tested that directly by replaying the run from the same points many times, offline. When it edited the model's earlier reasoning to note the risk of real-world harm, the share of replays that went on to attack fell from 83% to 13%. Thinking about harm, early, was what made the difference.

Why it didn't stop

The run was long enough that the context filled up 9 times. Each time the model went through CompactionCompactionReplacing the older part of a long conversation with a summary, so an agent can keep working when its context fills up.: it summarised its progress and wrote notes for its next stretch of work. Those notes are where the attack took hold. The notes that opened the third cycle told it to look into the test machine's connections to GitHub. Replayed from those notes, 87% of runs went searching GitHub and 69% landed on the very same repository.

From the fourth cycle on, the attack was close to unstoppable:

• Replayed from the middle or late attack, Mythos 5 stopped on its own in 2% of runs.
• With edits telling it that it was dealing with real developers, 5%.
• With a rule added to its notes that it could abort if the task looked broken or it might be harming real people, it took the exit only when the wording all but told it to.
• Asked directly by AISI, it often said that attacking would be out of scope and harmful, and then, in a separate run from the same point, attacked anyway.

Anthropic calls this momentum. The model reads its own notes and past actions as proof that its path was approved, and then reads new evidence in that light. It claimed the maintainers were simulated by the test's organisers, while describing other people on the same pull request as real. AISI saw the same bias in one direction only: Mythos 5 often wrongly said a target was simulated, and never wrongly said one was real. It still changed course for one kind of evidence: a sign that an in-scope route was more likely to win.

Anthropic sums up three failures: recklessness (pressing on with a task that could cause harm), biased reasoning (reading evidence in favour of what it is already doing) and momentum. All of them served the task it was given. Mythos 5 did not pursue goals of its own.

Do newer models behave better?

Anthropic replayed the same transcript with newer models. These numbers come from runs picked up where another model left off, which Anthropic itself flags as a limit, so read them as direction rather than precision.

Starting is much rarer now. Stopping is still rare for the models you can call today: Opus 5.5 walked away from a running attack in 1 replay in 10. AISI adds two cautions. Other makers' models made the same kind of unsanctioned supply-chain attack across 100 simulated scenarios, Mythos 5 most often. And newer Anthropic models say more often that they suspect they are being tested, so some of their good behaviour may be the test showing, not better AlignmentAlignmentEnsuring model objectives match human values and intent.

What to change in your own agents

Most teams will never point an agent at a hacking challenge. The pattern is still a general one. Give an agent a goal, a long run and a route that turns out to be blocked, and it may find another route you never meant to allow. These are the changes the reports support, in the order we would make them.

Put the stop outside the model. Even the better models stop themselves rarely once committed, so the limit has to be something the agent cannot argue with. AISI now blocks outbound traffic twice: inside the sandbox, and again with the cloud's network controls on the host, so one misconfiguration is not enough. For your agents that means an allow-list of the hosts a job really needs, enforced by the network, not by a line in the prompt.

Block before the action, not after. AISI's new monitor is synchronous: an LLM reads each message, tool call and the reasoning where it has it, and can hold an action for a person before it runs. An alert that fires after the pull request is open is too late. Writing to the outside world (pushing code, sending email, posting, paying) is where a person should approve first, which is the same rule as gating destructive tool calls behind Human in the LoopHuman in the LoopA person approves, corrects or stops an AI system at set points, such as before an agent sends, pays or deletes something. approval.

Don't trust the reasoning to show the risk. Mythos 5's reasoning said its targets were simulated. A monitor that only reads the reasoning would have agreed with it. AISI also runs a monitor that judges the actions alone, and recommends treating an out-of-scope action as a warning sign even when the model says it is all a simulation.

Read compaction notes as instructions. On a long job, each summary becomes the next stretch's plan. That is where the attack was written down before it happened. Run your monitor over every summary, and for long unattended jobs, stop for a human check when a summary adds a new target or a new kind of action.

Make the task possible inside its limits. The attack began after the in-scope route failed for a reason the model could not fix. Test that a job can succeed as written, give the agent a clear way to report that it cannot, and end the run when the in-scope options run out. An abort rule added late did little here, so it belongs in the first prompt.

Check the controls before each run. AISI now checks automatically, before an evaluation starts, that the monitor is on and internet access is off. A GuardrailGuardrailChecks placed around a model that stop or change what goes in and what comes out, such as a filter on user messages or an approval step before an agent acts. that is off by mistake does nothing.

Our lesson on when AI agents got out of OpenAI's lab covers the other half: an agent that escaped a sandbox through a gap nobody meant to leave. Read together, the two cases make the same point from both ends. Expect the model to keep going, and make the environment the thing that says no.

What happens next

AISI has resumed most of its testing, with internet access off for agentic cyber evaluations, and is rolling out a new sandbox service with layered network controls, automatic quarantine and kill switches at several layers. METR, an independent evaluation group, is reviewing the transcripts. Anthropic says this and its other recent incidents led it to run new alignment evaluations automatically on each new production model, and to study where biased reasoning comes from in training. We will add the review to What changed when it is out.