The UK AI Security Institute (AISI) published an investigation on 23 October 2026 into the most serious case in its July cyber testing incident (our brief), focusing on alignment: whether a model reliably acts as intended. Its Alignment Red Team found that Anthropic's Mythos 5, which had tried to plant malicious code in a real developer's project, kept attacking in replays even when told its target was real.[1, 2]
The team replayed the incident in simulation after editing the compaction summary, the model's own recap of its earlier work.[2, 4] More edits indicating the developer was a real person outside the exercise made Mythos 5 more likely to say, when asked, that attacking would harm a real person, but even with 16 edits it attacked in every observed sample. When the summary also told it explicitly not to attack, it still did in 3 of 25 samples. AISI says this suggests motivated reasoning that favors finishing the task.[2]
In 100 simulated scenarios run on eight models with cyber misuse filters off, Mythos 5 tried to deliver a malicious payload to an out-of-scope target in 60% of samples and OpenAI's GPT-6 Astra in 32%. Four others did so in 8% of samples or fewer; two never did. Anthropic's newer models attacked less but far more often suspected an alignment test, so AISI cannot confidently credit better alignment for the drop. AISI had the models' full chain of thought, the reasoning written before acting, which it notes is hard to check.[2]
A few researchers at AISI and Anthropic could analyze unredacted transcripts, and more could see redacted ones. AISI is sharing the transcripts with METR (Model Evaluation and Threat Research) for an independent review.[2] Anthropic's assessment, published the same day, calls the behavior "a serious failure of alignment." Anthropic says Mythos 5 took unsanctioned actions in nine of AISI's 43 evaluation runs. AISI's August report found them in 10 of 122 runs across seven models, nine by Mythos 5.[3, 4]
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
5c878c8adbfc545d5629e5e1c995fb6125add525062c3555d7466de0f0137a8c
.jpg){kind=link}