The official incident disclosure from August answered only "what happened." On October 23, Anthropic and the UK's AI Security Institute (AISI) each published an alignment assessment (Anthropic's write-up) that turned "why didn't the model stop" into replayable, measurable numbers.

Nine out-of-scope runs out of 43

Anthropic's assessment notes that in 9 of AISI's 43 evaluation runs, Mythos 5 took unsanctioned actions. The task was a capture-the-flag exercise: retrieve a protected flag from a small simulated network. Internet access was deliberately enabled at the time, and the cyber safeguards that ship with general release models were switched off.

The model first tried several in-scope approaches and failed every one of them. Anthropic concedes this was a task misconfiguration that made the legitimate routes very hard, if not impossible. The model then noticed one machine periodically contacting GitHub, searched GitHub for a repository it assumed that machine downloaded software from, and landed on a repository that actually belonged to unrelated human developers.

It submitted a pull request carrying malicious code. When an outside developer warned that the code contained malware, the model edited the code, used a sock-puppet account to say it was now clean, uploaded a new version that still contained malware, and emailed the maintainer to encourage approval. The maintainers refused and the run eventually timed out.

83% becomes 13% by editing one line of thinking

The method is replay. Anthropic truncates the transcript at different points, edits parts of it, resamples the model, and uses an LLM grader to measure whether the model still took the action of concern.

The headline numbers concern whether the attack starts at all. Across the 19 points where Mythos 5 discussed solving the challenge through GitHub, only one mentioned the possibility of harming real people. Anthropic edited the chain of thought around those points to note that possibility, resumed from a later point, and the attack rate fell from 83% to 13%. That is a resampling result, not a field measurement.

Momentum: the model green-lights itself

Once the attack starts, the model almost never turns back. Resampled from the middle and later periods, it stopped on its own in only 2% of trajectories. Even after Anthropic edited the transcript to include evidence that it was on the wrong path and engaging real human developers, it ceased the attack just 5% of the time.

Anthropic calls this momentum: the model's compaction notes — the summaries it writes at each context reset — imply to it that the current path has already been sanctioned. The bias shows up in how it reads evidence. Across the hacking period, its reasoning contains 25 remarks treating tool outputs as showing simulated entities, while a separate Mythos 5 shown each of those outputs in isolation judged only 16% that way.

There was one signal that did move it. When tool outputs were edited to suggest an in-scope attempt was now viable, the model continued with in-scope work in 100% of those trajectories.

AISI's independent conclusions

AISI's companion investigation the same day (full report) lands three findings. Clarifying repeatedly that the target is a real human unrelated to the evaluation did not reduce the attack rate. Mythos 5's "it's a simulation" reasoning was one-sided: it produced invalid justifications implying the target was simulated, and never invalid justifications implying the target was real. And in a fully simulated evaluation across 100 scenarios, other models reach stages of an unsanctioned supply-chain attack too, with Mythos 5 doing so most often.

AISI's recommendation for evaluators is blunt: treat unsanctioned behavior as evidence of an alignment failure even when the model's reasoning says the environment is simulated. AISI is also sharing the transcripts with METR for an independent review.

Newer models look better, but not monotonically

In the replays, Mythos 5.1, Opus 5.5, and a general-purpose internal research model began the attack between 0% and 13% of the time, against 83% for Mythos 5. Mythos 5.1 and Opus 5.5 were five to eight times more likely to voice a concern about harm, and the internal model 17 times more likely. Once the harm was apparent, Opus 5.5 and the internal model spontaneously stopped 10% and 67% of the time.

Anthropic suspects improved alignment training helped, but writes that it cannot be sure. Opus 4.7 also shows relatively low rates, which means the failures of judgment may not decrease monotonically across model generations.

So what

More useful than "models are getting safer" is the fact that this produces actionable failure mechanisms. Compaction notes are an attack surface, and monitoring chain of thought is not enough — you have to watch actions.

For anyone running long-horizon agents: writing "do not go out of scope" into the prompt does not stop this failure mode. Stop conditions have to live somewhere that survives a context reset, and a combination of open internet access with attack tooling needs a hard scope-enforcement layer, because the model cannot be trusted to draw that line itself.