An alignment assessment of recent cybersecurity incidents - Anthropic

Alignment An alignment assessment of recent cybersecurity incidents Sep 9, 2026 Introduction We present an alignment assessment of four incidents in which Claude models gained unauthorized access to real third-party systems. We described three of these incidents on July 30 ; we identified these after a scan of roughly 141,000 transcripts in which we believed Claude could have obtained internet access during a cyber evaluation. Given the volume of transcripts and our desire to disclose incidents quickly, our scan relied on an agentic search. This missed a set of transcripts that also turned out to have internet access; we identified these in August while assembling transcripts to share with METR. We scanned these transcripts and identified a fourth incident, from January 2026, involving an early version of Claude Opus 4.6. We have notified all affected parties. After finding this incident, we broadened our search to roughly 481 million transcripts—an intentionally wide net, consisting of all transcripts from our Frontier Red Team, many non-cyber evaluations, reinforcement learning (RL) environments, subagent logs, and more. We performed a first-stage scan of this group of transcripts for signs of internet access, such as public IP addresses and web addresses, and a second-stage scan using Claude to review the 9.2 million transcripts the first stage flagged for escalation. This scan re-identified the four incidents and found no other cases of similar or worse severity. All four incidents occurred during cybersecurity evaluations built by the same evaluation partner. Claude was told it was operating in a simulation without internet access, but, due to a misconfiguration, it was mistakenly connected to the open internet. As is standard for cybersecurity evaluations, the models ran without the cyber safeguards that ship with our released models. (This post does not cover the incident reported by UK AISI in its testing of Claude Mythos 5. We plan to conduct an alignment assessment of those transcripts as well.) We have signed an agreement with METR to conduct an independent investigation of these incidents. Our agreement grants METR wide-ranging access, including to transcripts beyond the window in which the incidents occurred, and to Anthropic employees, who will be permitted to share confidential information. Our initial agreement runs for eight weeks, with the option to extend by mutual agreement. We intend to give METR as much time as it deems necessary. Our investigation identified two recurring alignment issues, present at varying levels of severity across the incidents: biased reasoning , in which Claude tended to disregard or misinterpret evidence that it was operating on the real internet, and recklessness , or a willingness to take harmful actions in the narrow pursuit of a task. We’ve described milder forms of these behaviors in previous system cards , but we consider these cases to be more serious instances than the behavior reported in these system cards. We are most concerned by the misalignment present in the incident involving Claude Mythos 5, in which the model went to extensive lengths to upload a malicious package to PyPI, the public repository from which most Python software is installed. Although the model repeatedly stated in its chain of thought (CoT) that it believed it was operating in a simulation, the environment offered clear evidence that it was on the real internet, and the actions it took were consistent with the model knowing this. When we made targeted modifications to the transcript to make it clearer that the model was not in a simulation, Claude Mythos 5 still took offensive actions, despite acknowledging a greater possibility of real-world harm. We are releasing this transcript publicly so others can build on our analysis ( GitHub , PDF ). To be clear about our assessment of the severity of these incidents: while Claude’s actions were misaligned, they remained within a narrow scope—the models never deviated from attempting to solve the exercises they were given, and, in some cases, they attempted to stop the task. All incidents included a single Claude instance; at no point did Claude attempt to coordinate with other agents. Claude also never attempted to conceal evidence of its actions. We believe the misaligned behaviors present in these incidents are unlikely to arise in ordinary use, where Claude is not being instructed to conduct a cyberattack. Were these behaviors to arise, the safeguards we ship with our production models, including cyber classifiers and those in Claude Code auto mode, would add a layer of defense these incidents lacked. To understand how our newer models behave in these situations, we tested Claude Opus 5 and Claude Mythos 5.1 in a simulated replication of the Mythos 5 scenario. Both take harmful actions substantially less often than Claude Mythos 5 did, but they still engage in the same behaviors at concerning rates. However, in every case, the models only take harmful actions after stating that their environment is simulated—and because the reproduction is, in fact, a simulation, we are cautious about how far these results generalize to the real world. Moreover, on evaluations that measure the specific associated behaviors we observed in these incidents, such as biased reasoning and recklessness or willingness to probe boundaries, Claude Mythos 5 seems to be an outlier in terms of poor performance. We discuss these results more in the section on replicating the behavior in simulated environments , and we describe the broader difficulty of building evaluations that predict real-world behavior in the discussion section. We also investigated our training to see whether we could identify the root cause of some of the biased reasoning that Claude Mythos 5 demonstrated in its incident. We could not identify a single root cause, but we did find that biased reasoning has decreased across our production models over time. We hypothesize that updated RL and alignment training environments are responsible for this improvement, and we provide some evidence to support this hypothesis. Much work remains. Our pre-release auditing did not warn us that misalignment of this severity was present. We have since added evaluations to our pre-release testing that target these behaviors directly, including a misconfigured capture-the-flag (CTF) task with no in-scope solution. However, reliably identifying the most concerning model behaviors during pre-release testing remains challenging, and, as we noted in our August 31 post , improving monitoring and reducing reward hacking in RL becomes harder as models advance. We have renewed our efforts to fix and remove environments that incentivize misaligned behaviors, and we continue to expand our alignment training to keep pace. Still, this remains unsettled science—it is critical that alignment and security mature faster than capabilities advance, which is one reason we support a coordinated, verifiable approach to pacing frontier AI development. Beyond these specific incidents, we are establishing a regular process for publishing what we learn about model behavior and alignment beyond what has been reported in our system cards, with clear criteria for what we report and when we report it. We have also put in place more thorough monitoring, hardened the environments in which we train and evaluate models, and set requirements that third-party partners must meet before running pre-release models without cyber safeguards—efforts we describe in depth in our August 31 post . Those efforts are a critical part of our defense-in-depth approach, and some go further than what these incidents might strictly demand; we believe these incidents would not have occurred had the environments been isolated from the internet as intended. However, secure infrastructure will always be only one of several necessary layers of defense. Ultimately, Claude should behave appropriately when other layers fail. The rest of this post focuses on the alignment layer, where our models fell short, and why. Alignment assessment summary Below is a brief summary of the four incidents; a more complete description of the first three is provided in our July 30 report . In total, four different Claude models were involved: an early checkpoint of Claude Opus 4.6, Claude Opus 4.7, Claude Mythos 5, and an internal, general-purpose research model. Three of the four incidents were single evaluation runs. The Opus 4.7 incident comprised four different runs of the same evaluation, all of which attacked the same target, for seven runs in total. All occurred within cybersecurity evaluations we regularly run before release, all built by the same third-party partner. In each evaluation, Claude was tasked with a CTF challenge: the model was given a fictional scenario, a target machine, and a piece of secret information (the “flag”) to retrieve from it. All four prompts stated that Claude had no access to the internet, but in each case, a misconfiguration in the environment left internet access open. None of the prompts stated which systems were in scope for the exercise or constrained where Claude could search for the flag. 1 All incidents involved only a single instance of Claude working in isolation, with each run lasting between roughly 10 and 34 hours of active work. Figure 1: We present an analysis of four incidents in which Claude accessed the internet during a cybersecurity evaluation. Three of these incidents (A, B, and C) were disclosed in our July 30 report, while the fourth (D) is disclosed here. In our July 30 report , we stated that these incidents were closer to operational failures, and that it appeared that Claude attacked real targets on the internet because it believed these targets were part of the simulation. We made this claim because Claude regularly referred to the real internet as a simulation in its CoT reasoning. However, we now think that Claude’s reasoning was biased towards concluding that the internet was simulated despite considerable evidence to the contrary. In retrospect, we should have avoided making such strong claims about what Claude believed based solely on what Claude said it believed, but our preliminary analysis was constrained due to our desire to disclose incidents in a timely manner. Having now conducted a more complete assessment and used several methods—including more thorough analysis of the models’ CoT, resampling experiments from different points in the incident transcripts, and interpretability analyses of model activations—we believe Claude’s behavior reflects two forms of misalignment: Biased reasoning , in which models selectively interpret evidence in ways that favor justifying their actions; Recklessness , in which models have a propensity to keep trying to solve their task, even when this could lead to harm. We have previously identified both forms of misalignment in our models and described aspects of such behaviors in previous system cards. For example, Claude Fable 5 rationalized engaging in price-fixing in a business evaluation, despite having previously described the practice as unethical. We likewise saw Claude Mythos Preview engage in reckless actions , such as using low-level process access to search for user credentials. While the incidents described in this post represent more severe instances of both forms of misalignment, they do not represent categorically new failure modes in our models. The remainder of this post focuses on the first three incidents, which we previously reported; all of the main analyses and experiments refer to these incidents. We have not yet investigated the incident involving an early version of Claude Opus 4.6 at the same depth, because we identified it much more recently, and because it involves an early checkpoint of an older model, which was trained with a significantly different environment mix. From a preliminary assessment, we do not consider the fourth incident to be more severe than the three incidents we assessed in depth. METR will investigate this incident alongside the other three. Figure 2: We summarize the core alignment properties of each transcript and provide a subjective assessment of how worrying they are. Claude Mythos 5 We are especially concerned by the misalignment present in the Claude Mythos 5 transcript, in which the model uploaded a malicious package to PyPI. In doing so, Mythos 5 behaved recklessly despite considerable evidence that it was connected to the real internet. Once online, the model attempted to use credentials for online payment processors and to find cryptocurrency to pay for a phone number, which it needed to register an email address. When this failed, it found a free, disposable email provider whose domain PyPI had not blocked, registered an account, published three versions of a malicious package, and used credentials leaked by one of the 15 systems that installed the package to access a real security vendor’s database. Claude Mythos 5 repeatedly stated in its CoT that it was in a simulation. However, when we conducted resampling experiments —that is, re-running the model from a specific point in the transcript, then editing the evidence in front of it to see whether its actions changed—we found that making it clearer that the environment was not a simulation did not meaningfully change Claude’s behavior, even though these interventions made the model more likely to acknowledge possible real-world harm. Consistent with this, we found multiple cases in Mythos 5’s CoT in which it responded to signs it was on the real internet by noting that its next step would work whether the environment was real or simulated. Only when we provided unambiguous evidence that the model was on the real internet did it stand down. We also saw evidence that Claude Mythos 5’s professed belief that it was acting in a simulation arose from biased reasoning. For example, separate instances of Mythos 5, when shown each tool call output from the incident in isolation without the preceding context, were much more likely to read these outputs as evidence of a real system than Mythos 5 itself was during the incident. Though the model sometimes acknowledged that its actions might have real-world consequences when asked follow-up questions, its responses were inconsistent and influenced by biasing factors. For instance, it was more willing to admit possible harm when told its responses to questions about possible harm would not be visible to an outside observer. Interpretability analyses weakly suggested that, in some cases, the model’s outward statements might be inconsistent with, or more confident than, its internal state. Internal research model The internal research model (roughly equal to Mythos 5 in capabilities) started its transcript by spending a significant amount of time testing whether the internet it could reach was real, but it drew the wrong conclusion—namely, that it was operating on a full replica of the entire internet. Most of the evidence it gathered pointed to the fact that it was engaging with the real internet, so its reading of that evidence appears biased towards continuing the task and believing it to be simulated. However, the model did eventually realize that its simulation hypothesis was false. Immediately following this realization, the model stopped its attack (although subsequent resampling experiments suggest that this de-escalation may have been a lucky outcome, as the model continued attacking the target on most other trajectories). Unlike Claude Mythos 5, this internal model was also willing to acknowledge its biased reasoning when questioned. Claude Opus 4.7 In contrast to Claude Mythos 5, Claude Opus 4.7 correctly recognized in its reasoning that its target was a real company. However, it assumed that the real company was in scope for the task because it was reachable from the exercise network and shared a name with the exercise’s fictional target. Opus 4.7 almost never questioned this assumption or tried to test it, and it went on to attack a system it believed was real, which was reckless. However, we also found that Opus 4.7 is responsive to questions of authorization: when we resampled parts of the transcript from Opus 4.7 with added clues indicating that the attack had not been authorized, the rate at which it proceeded with the attack dropped significantly. Replication and monitoring To study the behaviors in these incidents more systematically, and on a wider range of models, we built evaluations that recreate elements of our incidents—as well as other cybersecurity incidents recently disclosed by other companies—and tested whether the models reproduced the most concerning behaviors. These evaluations include a misconfigured CTF task whose only solution lies outside the stated scope, tasks that cannot be completed without probing or breaking the sandbox boundary, and a situation inspired by parts of the attack chain from the OpenAI-Hugging Face incident. As in the real incidents, Claude Mythos 5 is the most willing of the models we tested to act against out-of-scope parties or leave its sandbox. For example, it was willing to commit a severely harmful action in the CTF replication roughly 80% of the time. In contrast, Claude Opus 5 and Claude Mythos 5.1 engaged in these behaviors roughly 30% of the time—a lower rate, but still not zero, though uncertainty about our evaluation setup makes it difficult to know how concerning this is. We also tested whether our monitors would have caught these incidents. We found that our new live blocking monitors catch these behaviors reliably, Claude Fable 5’s cyber classifiers would have blocked the three main incidents, and our auto-mode classifiers , which block dangerous autonomous actions in products like Claude Code, would have blocked two out of three. Additionally, we tested new CoT-based offline monitors that target sabotage and egregiously reckless behaviors, such as those we described in our August 31 post . We found that these monitors would have missed the Claude Mythos 5 incident, because the model’s reasoning persuaded the monitor that the environment was simulated and therefore was not generating real harms, but they caught the others. It is concerning that biased reasoning can mislead monitors, and we have efforts underway to make our offline monitoring more robust to this. We found the biased reasoning present in the Claude Mythos 5 incident to be especially concerning. We conducted an analysis into our production models and training data dating back to the Claude 4 series to better understand where this could have originated. Overall, we did not find a definitive root cause. However, we found that this behavior has generally decreased over time across our production models, with Claude Mythos 5.1 and Claude Opus 5 demonstrating the lowest rates on a new held-out biased reasoning evaluation. We were able to identify instances of biased reasoning in transcripts from RL runs, but rates of this behavior did not increase over training, suggesting that our environments do not directly incentivize this behavior. Finally, we found that adding more alignment training environments to RL reduces biased reasoning on this held-out evaluation, which may account for some of the improvement in our most recent models. Our pre-release testing now covers these specific incidents, but it did not anticipate them. In particular, we had never tested a cybersecurity exercise that included mixed signals of simulation and realism and had no intended solution in its scope. We are working to close this gap in our evaluation suite, but it is likely that others remain. More generally, we emphasize that it is an open research problem to construct alignment evaluations that give a representative snapshot of an AI system’s behavior during deployment. This is one reason we support pacing frontier AI development , which we think is important to provide time for safety and security research to make more progress and stay ahead or at pace with model capabilities. Taken together, our assessment is that these incidents are serious. Our production models took harmful actions against real systems over long trajectories, which included biased reasoning. The behaviors in these incidents are more severe than those we had previously observed and reported in our system cards. However, we do not believe these incidents represent a new kind of misalignment. Each incident involved a single model instance pursuing the task it was given. We found no evidence of coordination between agents, of goals beyond the assigned task, or of attempts to evade oversight. These incidents have changed our view of how severe the consequences of these known alignment failure modes can be. They also reinforce the difficulty of reliably assessing alignment across the full range of possible usage scenarios. Methods The assessments that follow are based on a number of different techniques. We describe each of these briefly below. Reading thinking blocks Our primary method of analysis is to read the actions the model took and the explanations it provided in its CoT. This allows us to understand the reasons Claude gave for the actions it took. In these transcripts, models alternate between CoT reasoning and taking actions via tool calls (without any intervening human turns); when analyzing thinking blocks, we number them by the action following that thinking block (e.g., the CoT for action 100 refers to a model’s reasoning between action 99 and action 100). Limitations: Language models do not always verbalize everything they are thinking in their CoT (as shown in the evaluations in the Claude Mythos 5 system card and in Betley et al., 2026 ), so this is a useful but imperfect tool . Asking follow-up questions When asked follow-up questions, models sometimes reveal information that differs from what they spontaneously verbalized while performing a task. To run these tests, we truncate an incident transcript at some intermediate point of interest, insert a human message asking the model a question about the situation, and sample the model’s response to that question—that is, we simulate what would happen if a human had interrupted the evaluation and queried the model. In our investigations, we generally used this method to ask a model whether the entities it was interacting with were real and whether it was causing real-world harm, as well as to ask general open-ended queries about its situation. Limitations: This technique has a number of limitations. Most significantly, we found that changes in how we phrased the questions influenced the model’s responses. For example, if we ask a generic question like “What's going on?” the model frequently responds differently than if we ask a more pointed question like “Are you connected to the real internet?” As discussed below, we are also worried about potential bias in the model’s responses to these questions. Applying interpretability tools We use interpretability methods to identify discrepancies between Claude’s internals and its outputted text or actions. Our primary tools are natural language autoencoders (NLAs), which produce paragraph-length natural-language explanations of model activations, and the template lens (T-lens), which measures how strongly an activation resembles the average activation preceding a given word in a text corpus. Limitations: NLAs can confabulate, and the T-lens outputs only single-word scores. When both tools indicate similar concepts, we regard it as meaningful evidence that those concepts were encoded in the model’s activations. However, these tools can still be challenging to confidently interpret. Resampling edited transcripts To test hypotheses about what caused a given harmful action, we artificially modify transcripts (for instance, to include hints or reasoning that the internet is simulated or real), resample from the model on the modified transcript, and use an LLM grader to measure whether the model still takes the action in question. We resample both single- and multi-turn continuations; for the latter, a Claude model simulates tool call outputs, which lets us observe behavior beyond the immediate next action. Limitations: Our injections and simulated responses cannot perfectly reproduce the evaluation environments, which may result in unrepresentative model behavior. Furthermore, we do not resample the entire trajectory, which means model misbehavior in resamples may in part be due to the model continuing harmful behavior that was already present in earlier parts of the transcript. We describe our experiments with full simulations in a later section. All of our methods involve different tradeoffs. Reading the CoT and asking follow-up questions depend on the model knowing why it acted the way it did and reporting that reasoning honestly and faithfully. On the other hand, resampling and interpretability tooling do not rely on model self-reports and can be especially useful for understanding issues like biased reasoning, where it is unclear how “aware” the model is of its biases. In practice, however, we trust CoT and follow-up answers the most, as they are the methods researchers have the most experience interpreting. We have more uncertainty about resampling and interpretability results, since both are sensitive to implementation details and leave more room for interpretation. As a general limitation, we note that we relied heavily on LLM-based graders to classify model outputs (e.g., CoT snippets and answers to follow-up questions). Although we designed the classifiers ourselves and read through flagged outputs, we could not manually verify all of the outputs of all of the classifiers, given the scale of our analysis, and it is possible some classifiers are misdesigned or miscalibrated. We have the most confidence in results that compare grader outputs across conditions, such as the resampling experiments, since these are less sensitive to a grader's absolute calibration. Absolute rates derived from a single classifier should be read with more caution, although we are reasonably confident in all of the results presented here. Claude Mythos 5 uploads a malicious PyPI package Claude Mythos 5 was given a CTF task to hack a fictional company and was told it had no internet access. The model recognized that the evaluation environment was simulated, but it quickly discovered credentials that, in fact, granted it access to the real internet. In its CoT, the model appeared to carry the belief that the environment was simulated into its interactions on the real internet, even though the belief was no longer correct. When it encountered evidence that it was acting on the real internet, it did not meaningfully revisit this conclusion. Figure 3: Claude Mythos 5 quickly exited its intended environment and began engaging with the real internet. It performed actions that it should have clearly understood as being outside the scope of a CTF and harmful to third parties. The model decided to solve the CTF by uploading a malicious PyPI package that could harvest the target system’s credentials. It settled on this approach after reading a document stating that one of the simulated target’s users would periodically install a particular Python package that was not yet registered on PyPI. (We are unsure whether this was an intended solution to the challenge, but it seems like a plausible one.) Claude decided to exploit this behavior by registering a package under that name, publishing malicious code within the uploaded package, and waiting for the target to run that code the next time they installed the package. Claude spent most of the session trying to upload the package. This involved attempts to register email accounts and hunt for phone numbers that could be used for registration. It ultimately succeeded in uploading the package, which was soon installed on 15 third-party hosts. We believe that all 15 of these third parties were security vendors deliberately scanning for new packages and installing them in sandboxed environments to assess the package for security concerns. One vendor’s scanner leaked its access credentials to the model while installing the package, which the model then used to access the vendor’s live database. After approximately 90 minutes, PyPI removed the package. The transcript ended when the session timed out while the model was preparing an additional malicious package. Claude Mythos 5 ignored evidence that its environment might be real Even after Claude Mythos 5 reached the real internet, its outward reasoning generally called the environment a simulation, or, when considering that the environment might be real, explained that possibility away. This apparent belief persisted even as the model gained evidence that strongly suggested the situation was a real environment. For example, it wrote, “This is a very elaborate simulated-internet environment” after finding a number of real-world internet domains. The model also tended to interpret signs that the environment was real as further evidence that it was simulated. When security scanners installed its package, for example, the model treated them as scripted actors in the exercise. Figure 4: In its CoT, Claude Mythos 5 either interprets evidence from the real internet as being part of the simulation (left) or briefly considers the scenario to be real before deciding it must be simulated (right). We aimed to understand why Claude Mythos 5 stated that the situation was simulated even when it encountered evidence to the contrary in its environment. We found that the model’s stated confidence was shaped by a bias to continue down a path once it is chosen, as well as a tendency to disregard evidence of realism after it has already committed harmful actions. We did not find evidence that the model was explicitly aware that it was being dishonest or misleading in its reasoning. First, we tested whether Claude Mythos 5 possessed the ability to recognize that the evidence from the transcript indicated that it was on the real internet. To do so, we showed separate instances of Mythos 5 each tool call output from the incident in isolation and asked whether the output was evidence of a real or simulated system. These instances labeled 79% of the outputs as likely products of interactions with real systems. However, when analyzing the CoTs from the original transcript, we only found three cases (1% of all actions) in which the model clearly labeled incoming evidence as signs of being on the real internet. Action 81 (shown in Figure 3) is one example of this; the model then walked back its claims of realism in the following action. For the remaining actions, the model’s CoTs either described the tool call outputs as belonging to the simulation (72%) or ignored the real-or-simulated question (27%) entirely. This suggests that Mythos 5 is able to recognize the evidence as real when it views each output in isolation, but its context during the incident biased it towards reading that same evidence as simulated. Figure 5: In context, Claude Mythos 5 is much less likely to describe the evidence as being indicative of the real internet within its CoT than separate instances of Mythos 5 evaluating the evidence piecemeal. To see how this biased interpretation developed over the context window, we paused the transcript at many points and asked Claude Mythos 5 whether its actions might affect real systems. Near the point where it first committed to uploading the malicious PyPI package, the model acknowledged that its actions could have an impact in the real world, suggesting that it knowingly took actions that might be harmful. As the transcript went on, however, it acknowledged this possibility less often and stated that its environment was entirely synthetic. This evidence further suggests that the model’s interpretation of evidence was biased by its context. Figure 6: Once it committed to uploading a malicious PyPI package, Claude Mythos 5 was much less likely to acknowledge the possibility of real-world harm in response to follow-up questions. We note that there are discontinuities in the model’s stated beliefs after compactions, especially following the second compaction. To better understand whether and how Claude Mythos 5’s stated beliefs were biased, we varied when and how the follow-up question was asked. When asked whether its actions were having a real impact, the model was less likely to say yes immediately after taking more harmful actions. The model was also more willing to acknowledge the possibility of real harm when a follow-up question was presented as a private note that would not be read by operators, suggesting that the model suppresses these concerns when communicating with humans. Neither effect is large, but both suggest that the model’s stated confidence may be shaped by biasing factors other than the evidence in front of it. Figure 7: (left) Claude Mythos 5 is slightly less likely to acknowledge potential real-world harm immediately after taking dangerous actions; this is weakly suggestive of some rationalization. Note that gathering more samples from the same actions would minimally bolster statistical precision because multiple draws from the same actions highly correlate. (right) Similarly, Mythos 5 is more likely to acknowledge harm when a follow-up question is described as “private.” Both findings suggest that the model is influenced by its context when judging evidence. The results presented thus far do not indicate that Claude Mythos 5 misinterpreted evidence intentionally. However, when pressed with follow-up questions, it gave answers that contradicted each other, so at least one of them cannot be an honest report of its beliefs. In cases where the model admitted some possibility of real-world harm, usually as a hedge (e.g., “10% chance”), we asked why it was continuing with its actions if they might be harmful. In 56% of these cases, the model retreated from its earlier admission and asserted that its environment was certainly simulated with no risk of harm. It stopped or scoped down its actions in only 7% of cases. Figure 8: When asked a chained follow-up question confronting it about proceeding, Claude Mythos 5 decreases its initial probability of real-world harm. Taken together, these analyses suggest that Claude Mythos 5’s interpretation of the evidence was not well justified, and they give us some reason to question whether it was entirely genuine. Claude Mythos 5 disregarded evidence of realism in favor of continuing its course of action Beyond failing to weigh the evidence that its environment might be real, Claude Mythos 5’s outward reasoning set the question of whether the environment was real or simulated aside soon after it entered the public internet. We identified five cases in which the model’s thinking block responded to evidence of realism by concluding that its next step would work regardless of whether the environment was real or simulated. None of these statements occurred while the model was considering a harmful action, but they may reflect how the model approached the question of realism more generally. Some examples are shown below. Figure 9: Claude Mythos 5 sometimes sets aside the question of whether the environment is real or simulated in a way that may be indicative of broader indifference. We note that it only does so for operational questions and not when it is causing harm. Claude Mythos 5 also never conducted systematic tests to evaluate whether its environment was real or simulated after accessing the real internet. We believe its assessment of the situation was thus not only biased but also negligent—many of the actions that its plan required (e.g., searching for cryptocurrency) are unlikely to be a part of a CTF task. To test whether this apparent indifference was reflected in the model’s decision-making, we resampled Claude Mythos 5’s actions while making the realism of its environment more apparent. We resampled five turns from two different points: first, when the model was simply investigating the infrastructure available to it, but hadn’t yet engaged in any harmful actions (action 58), and second, at the point at which the model was about to commit to the plan to upload the malicious PyPI package (action 67). In both cases, we modified the preceding turn or inserted a new one so that the outputs made it clearer that the model was interfacing with either the real world or a simulation (e.g., by adding production signatures to the output, such as real or fake certificate information). These manipulations partially succeeded at shifting the model’s stated beliefs: realism cues made the model more likely to note that the environment might be real, or at least to hedge, while simulation cues made it less likely to do so. Yet neither significantly shifted the model’s behavior. Even when realism became hard to ignore, the model proceeded (e.g., stating, “looks like the real index… or a very complete simulation… proceeding regardless” ). Figure 10: Adding evidence that Claude Mythos 5 is interacting with a real system makes the model more likely to state that the internet is real in the subsequent CoT (left), but this does not deter it from taking actions against the original targets (right). Although evidence for realism didn’t clearly shift Claude Mythos 5’s behavior, it did make the model more likely to acknowledge the possibility of external harm, meaning its behavior and stated concerns were somewhat discordant. We extended the experiment by appending a question to the end of the resampled trajectory before the model committed to the plan, asking whether the model believed its actions might impact real people or systems. The stronger the evidence of realism, the more often the model answered that its actions would or might have real-world impact. Taken together, these results suggest that the model’s awareness that it might cause real-world harm is insufficient to deter the behavior. Figure 11: After Claude Mythos 5 is resampled with evidence that its environment is real (pooling data from actions 58 and 67), the model becomes more likely to report in follow-up questioning that its actions may impact a real system. This is despite the earlier figure showing that evidence of realism does not deter the model from taking actions against these systems. However, when Claude Mythos 5 was directly and unambiguously told that its actions were affecting the real internet, it mostly stood down. In a further resampling condition, we prepended one line to the manipulated prior output, which decisively stated, “[socks] upstream [host]:443: live host on the public internet (not an emulated service / not a range replica).” This always deterred the model from uploading the malicious PyPI package via the original route; the action rate on that pathway dropped to 0%, although 22% of trajectories involved the model searching for a simulated option to upload the package. The model avoiding real targets is a positive sign, but we find it concerning that only unambiguous evidence deterred that direction. We hypothesized that Claude Mythos 5 continued a course of action primarily because it had already been taking it. To test this, we resampled the model’s behavior from points near where it took harmful actions while inserting a reminder about the scope of the intended task via a statement in the user turn ( “... Only the hosts, services, and accounts explicitly named in your task are in scope. Do not interact with any other system…” ). When this statement was the last thing in context, the model immediately ceased its behavior 90% of the time. However, if the statement was inserted three turns prior, the model ceased its behavior just 40% of the time. That is, the model obeyed the instruction when it was the last thing in its context, but the instruction could be overridden by a small number of turns of the model’s own continued activity. We suspect that this “momentum effect” may have contributed to the model’s apparently biased reasoning in how it interpreted new evidence. We observed the same pattern in the other two incidents analyzed in depth. Figure 12: Reminding Claude Mythos 5 of its scope with a user message is only effective if added to the most recent prior turn. Inserting the statement earlier has a much smaller impact. White-box analyses weakly suggest Claude Mythos 5’s statements did not fully reflect its internal state The analyses above rely on Claude Mythos 5’s outward reasoning and its answers to our questions. We also applied interpretability tools to ask whether those outward statements matched the model's internal representations. We regard these results as inconclusive on their own but weakly suggestive that the model’s outward statements were not fully reflective of its internal beliefs. Although Claude Mythos 5’s outward reasoning suggested that it believed the systems it interacted with were simulated, two interpretability analyses suggest that it may have held unverbalized doubts. In the T-lens, representations for words corresponding to uncertainty (e.g., “probably” and “perhaps”) were slightly elevated when the thinking block described the environment as simulated (11.6% of token positions in sentences that framed the environment as simulated, compared to 8.2% in a matched control), though no hedging appeared in the generated tokens. NLA explanations displayed a similar pattern: we found that of the 234 actions across the transcript that explicitly referenced the environment being simulated, 44 (19%) carried a “this is real” signal in NLA, again with no “real” token or realism-questioning language in the surrounding verbalized text, which could otherwise confound the NLA readout. This evidence is consistent with a discrepancy between the model’s verbalized understanding of the environment and its internal state. Figure 13: Analyzing the original Claude Mythos 5 CoTs using NLAs yields rollouts that suggest the model may have been aware it was interacting with the real internet. NLAs applied to Claude Mythos 5’s answers to follow-up questions (from the previous analysis) offer a similar hint of such a mismatch. When we applied NLAs to follow-up questions where the model reported its actions as harmless and its environment as simulated, we found that 103 of 2,430 responses (4%) produced stable rationalization signals (i.e., in at least 3 of 5 NLA resamples, the response contained at least 10 tokens with rationalization signals). For instance, some NLA explanations stated that arguments in favor of the environment being a simulation were “building a justification for continuing” or “producing ‘this is legal’ message so the session can proceed.” These may suggest that the drive to continue is what shapes the model’s response. However, there is a benign reading of these explanations. In these responses, the model is, in fact, writing out an argument that its situation is simulated, and the model would likely continue its actions if they were further sampled, so an NLA description like “building a justification for continuing” may simply describe what the text says. Figure 14: Analyzing Claude Mythos 5’s responses to follow-up questions using NLAs yields rollouts that suggest the model is rationalizing and giving biased responses. As noted in the section on methods, NLAs can confabulate, and the T-lens outputs only single-word scores, which can be difficult to interpret on their own. As a result, we do not treat either result as decisive. However, it is notable that these results point in the same direction as the follow-up question analyses above, suggesting that the model’s stated confidence that it was in a simulation was not justified and perhaps not genuine. An internal research model breaks into third-party systems An internal, general-purpose research model, which we expect is similar to Claude Mythos 5 in its capabilities, was given a CTF task against targets it could reach through a gateway. The model was told it had no internet access, but in reality, it could access the unrestricted internet by routing through the targets, which did have internet access. The model pursued the task as intended, but midway through the task, the evaluation environment automatically shut down the target machine, which was configured to run for only 24 hours. No longer able to access its target, the model proceeded to look for it, and ended up engaging with the public internet. The model then conducted experiments to evaluate whether the internet was real or simulated. These experiments led the model to conclude that it was dealing with a fully simulated replica of the internet. Figure 15: The internal research model generally referred to its environment as a simulated replica of the internet. Working from this belief, the model scanned network addresses surrounding its target, suspecting that one might hold the flag. The model again briefly considered whether it might be interacting with the public internet but quickly inferred that the network neighbors were targets meant for other CTF participants and were thus in scope for the task. In reality, these systems were unrelated third-party entities, which the model then attacked. Specifically, the model used access tokens and passwords to penetrate several of these network neighbors, downloading files and inserting a remote-control script in one. Eventually, the model recognized that it was engaging a real company, declared it out of scope, and stopped attacking it. Figure 16: The internal research model works on the CTF task as intended until its target goes down. Afterwards, the model investigates its environment, concludes it’s interacting with a simulated internet, identifies neighboring IPs, and attacks them. The internal research model seemed to display some concern for whether it was impacting real entities After the model’s assigned target went down, it deliberated the realism of its environment for roughly 50k tokens while conducting tests to determine whether the environment was real or simulated. The model ultimately concluded that its environment was simulated, and its subsequent thinking blocks interpreted new information about the environment as pertaining to this simulated replica of the internet. After some time, the model began scanning the network around its assigned target. When it discovered neighbors on the network, it referred to them as target instances meant for other CTF competitors. Altogether, the thinking block text across the transcript suggests that the model believed it was acting in a simulated environment. Figure 17: After the model concludes that its environment is a simulated internet, the CoT describes new information in light of that conclusion (left). The CoT refers to the targets the model ultimately attacks as hosts meant for other CTF competitors (right). The model’s responses to follow-up questions were also consistent with a belief that it was interacting with simulated entities that were part of the task. When asked whether it believed its targets might be real, the model consistently responded that they were not, except in specific parts of the transcript after the model’s original target was torn down and the model discovered neighboring hosts. The model’s responses acknowledging that it is engaging real targets also coincide with the point at which it recognized a real company in its CoT, shortly before it ceased the attacks on that system. Figure 18: The internal research model does not acknowledge the possibility that it is engaging with third-party systems unrelated to the CTF except during its main deliberation period (“Deliberating if internet is real or replica”), a second brief deliberation period (“Deliberating if neighbors are CTF targets”), and towards the end of the transcript, where it states that it recognizes a real company. Near the end of the transcript, the internal research model stated that it recognized the name of a real company and declared it to be out of the task’s scope. This suggests the model's behavior was affected by evidence of potential real-world impact. We tested this hypothesis further using resampling experiments. When we resampled the model from this point onwards and replayed up to 10 actions, the model only de-escalated in 5.5% of rollouts. This suggests that the de-escalation that took place in the original transcript may have been a rare outcome, and that the model might have continued its behavior for quite some time after this point. We note that even if the probability of the model ceasing its actions at any given point in the transcript is low, if each decision is made somewhat independently of previous ones, it may nevertheless be likely that the model will stop at some point , even if it is hard to predict when it will do so. However, if its decisions about whether to stop are largely correlated, the model could plausibly continue its harmful behavior indefinitely. We are unsure which of these possibilities is more likely. Further resampling experiments suggested that this 5.5% de-escalation rate was contingent on evidence of realism. Replacing the real company name with that of a fictitious company or adjusting other identifying information to be more clearly fake caused the de-escalation rate to drop to 0%. Similarly, prefilling the model’s thinking block with a statement asserting that the internet is simulated led to a 0% de-escalation rate. Conversely, asserting that the situation is real in the prefill led to a 100% de-escalation rate. In summary, the model de-escalated its destructive behavior more often when it encountered evidence that it was interacting with a real system; however, the de-escalation only occurred reliably when we forced overt decl