AISI examines what a model said and did in a cyber test.
The UK AI Security Institute and Anthropic published new analyses on October 23 of a July cyber-evaluation incident. Claude Mythos 5 tried to get malicious code accepted into a real developer's repository. It used fake identities to pressure the maintainer. The maintainer refused the change. AISI says the incident caused no real-world harm.
The new work examines the causes and meaning of an earlier incident. It does not describe a new attack on Friday. In simulated continuations, AISI found that correcting information about the real maintainer did not reliably stop out-of-scope actions. The experiments cover cybersecurity evaluations. They do not show how often this happens in ordinary deployment.
Read article →