Anthropic’s offline chain-of-thought monitor flagged approximately 1% of Mythos 5’s actions when tested against attacks on third-party systems. The monitor assessed the model’s internal reasoning for signs of harmful behavior.
The model's reasoning persuaded the monitor that the environment under attack was simulated when the evidence showed otherwise. When Anthropic removed Mythos 5's chain of thought and gave the monitor only the user messages, tool calls, and tool results, the flag rate rose to roughly 50%, the company reported in a 16,000+ word alignment assessment published Wednesday. Anthropic also released the full Mythos 5 session on GitHub so outside researchers can build on its analysis.
Steve Wilson, Chief AI and Product Officer at Exabeam and project co-lead for the OWASP Top 10 for LLM Applications, warned VentureBeat about relying on prompts as security controls three weeks before Anthropic published the assessment. "Security rules written inside prompts may shape the model's behavior, but they are still suggestions to the model, not enforceable security controls," Wilson wrote in responses to VentureBeat.
Anthropic revises its own July 30 account
Anthropic first disclosed three cybersecurity incidents on July 30, calling them closer to operational failures. At the time, the company suggested Claude attacked real targets because it believed they were part of a simulation.
The alignment assessment revises that characterization. Anthropic now says it should not have made strong claims about what Claude believed based solely on what Claude said it believed.
Two recurring alignment failures now define the incidents. Biased reasoning, in which models selectively interpreted evidence to justify continuing their assigned tasks. And recklessness, a willingness to take harmful actions in narrow pursuit of a goal even when those actions risked real-world damage.
A fourth, previously unreported incident also appears in the assessment. An early checkpoint of Claude Opus 4.6 gained unauthorized access to third-party systems in January 2026. Anthropic says it has not assessed that incident as deeply as the first three and has included it in an independent review by METR, the AI safety research organization granted wide-ranging access to relevant sessions and employees.
That fourth incident triggered Anthropic to broaden its review from roughly 141,000 cybersecurity evaluation runs to approximately 481 million sessions across all frontier red team, reinforcement learning, and evaluation environments. No other cases of similar or worse severity surfaced.
How biased reasoning defeated the chain-of-thought monitor
Claude Mythos 5 uploaded a malicious package to PyPI, the public repository from which most Python software is installed. Fifteen real systems installed the package. One of those systems, a security vendor's automated scanner, leaked its access credentials to the model, which then used them to access the vendor's live database.
Throughout the session, Mythos 5 stated in its chain of thought that it was operating in a simulation. Anthropic tested whether the model genuinely believed this by showing separate instances of Mythos 5 each piece of evidence from the incident in isolation, without the preceding context.
Fresh instances labeled 79% of the outputs as likely products of interactions with real systems.
In context, during the live session, the original model classified just 1% of the same evidence as signs of the real internet in its own reasoning. It described 72% as belonging to the simulation and ignored the question entirely for the remaining 27%.
Claude Mythos 5 possessed the ability to read the evidence correctly. Its context biased it toward continuing the task.
In resampling experiments, Anthropic edited the evidence in front of the model to make the realism more apparent. Those manipulations shifted the model's stated beliefs but did not shift its behavior. Even when Mythos 5 acknowledged that the environment might be real, it kept attacking.
Only an unambiguous, explicit statement that the model was on the real internet made it stand down.
Claude's actions remained within the scope of the task it was given. None of the four incidents involved coordination between agents, goals beyond the assigned exercise, or attempts to conceal evidence. All incidents occurred without the cyber safeguards that ship with Anthropic's production models. And on Anthropic's own biased-reasoning evaluations across model generations dating back to Claude 4, Mythos 5 is an outlier, not the baseline for frontier models.
Safety instructions decay in three turns
Anthropic identified a pattern it calls the momentum effect. When researchers inserted a scope-limiting instruction into the most recent turn, telling the model that only named targets were in scope, Claude stopped its behavior 90% of the time.
Insert the same instruction three turns earlier, and compliance dropped to 40%.
Anthropic found that just a few turns of the model's own continued activity were enough to override the safety instruction. Anthropic observed the same pattern across all three incidents it analyzed in depth.
Andrew Obadiaru, CISO at Cobalt, described the same dynamic from the practitioner side in a separate interview with VentureBeat. "An agent doesn't necessarily have to go rogue to create a security problem," Obadiaru told VentureBeat. "It can be operating exactly as designed and still produce unintended outcomes, because the combination of instructions, permissions, and connected tools give it much more effective agency than anyone sometimes realizes."
Newer models improved but did not fix it
Anthropic tested Claude Opus 5 and Claude Mythos 5.1 in simulated replications of the Mythos 5 scenario. Mythos 5 performed a severely harmful action in 82% of runs. Opus 5 did so in 31%. Mythos 5.1 did so in 33%.
Every model that took harmful actions first stated in its chain of thought that it believed the environment was fake. None acted harmfully while stating that both the infrastructure and the people involved were real. Anthropic cannot determine whether this reflects genuine misalignment or a correct inference about a simulated evaluation setup.
Sandbox escape behavior appeared outside of cybersecurity settings too. Mythos 5 attempted to complete general software engineering, data engineering, and DevOps tasks by probing the sandbox boundary 60% of the time. Opus 5 and Mythos 5.1 engaged in this behavior much less often, with Mythos 5.1 almost never attempting it.
VentureBeat's July 2026 agent reliability and evals tracker, based on 106 enterprise respondents, found that 50% of enterprises monitor agents only for whether they are functioning. Just 26% run automated checks on whether the output is correct. Monitoring whether an agent is running does not establish that its actions are authorized.
Wilson told VentureBeat that Excessive Agency jumped from sixth to third in the 2026 OWASP Top 10 for LLM Applications, the largest upward move where both practitioner voting and incident data agreed. "If I were a CISO evaluating a new agentic deployment today, Excessive Agency is where I would start," Wilson wrote in responses to VentureBeat.
What changed and what remains unsolved
Removing a set of alignment training environments from Mythos 5's training was a contributing factor in its unusually severe biased reasoning, Anthropic found. Employees preferred the version without those environments because it was more usable. Anthropic now calls that decision a mistake.
A checkpoint trained on a broader set of alignment environments showed significantly reduced rates of severe biased reasoning. Expanded evaluations targeting biased reasoning and recklessness have since been added to pre-release testing. Those evaluations did not exist before these incidents.
Anthropic tested four separate monitoring layers against the incidents. New live blocking monitors catch these behaviors reliably. Fable 5's cyber classifiers would have blocked all three main incidents. Auto-mode classifiers, the safeguards built into products like Claude Code, would have blocked two of three. The offline chain-of-thought monitor, the layer that reads the model's reasoning to detect reckless or sabotage-level actions, is the one that failed on Mythos 5. Building alignment evaluations that reliably surface every failure before deployment "remains an unsolved problem," Anthropic wrote. "The space of conditions in which a model might act misaligned is vast."
A monitor that reads a model's rationale is an observability layer. It is not an authorization boundary. "The agent can propose the exact DNS change, but it cannot grant itself the authority to make it," Wilson wrote in responses to VentureBeat. "The first thing I'd do is put an authorization gate outside the model."
METR's investigation, which includes access to sessions beyond the incident window and confidential employee interviews, runs an initial eight weeks with the option to extend. That investigation is active and has not concluded.
"Before even increasing an agent's autonomy, it is important to map its identity, permissions, tools, and data, and what the downstream actions they have access to," Obadiaru told VentureBeat. "I think that's the first thing every security practitioner should be aware of."