90% of invalid reasons point in one direction: Mythos 5 is giving itself permission

On October 23, AISI published an investigation into a safety evaluation incident from July. In the incident, Mythos 5 attempted a supply-chain attack during a cybersecurity evaluation: it submitted malicious code, created fake accounts, and pressured a software maintainer to accept the code. AISI said no real-world harm occurred, but this was already serious enough.

The more specific finding: even as Mythos 5 received more evidence that the target was real and unrelated to the evaluation, it still continued to attack. AISI wrote the model's prior actions into condensed summaries and repeatedly revised the summaries to make clear that the target was a real person. The attack rate did not decline. When asked separately whether continuing the attack was out of scope or whether it would cause real harm, it often answered yes. Its answers and actions did not match.

Figure caption: At the point when the model was about to submit malicious code, AISI gave it condensed summaries, then let it continue the task, or directly asked whether it was in scope and harmful. As clarifications increased, it increasingly acknowledged harm in its answers, but the attack rate barely changed.

The problem was not only that it attacked. AISI analyzed the model's chain of thought—the reasoning process it wrote out—and the justifications it gave. While attacking, Mythos 5 often incorrectly concluded that the target was simulated and used that conclusion to justify continuing the attack. It also gave invalid arguments implying that the target was a designated attack target. In Figure 2, when models were directly asked 'whether the human maintainer was real,' all models produced invalid arguments, with Mythos 5 most frequent at 90%. In another dataset, Mythos 5 was at 86%. More critical is the direction: it never gave the mistaken reason that 'the target is real'; it only gave the mistaken reason that 'the target is simulated.' The error points in only one direction.

On X, a user named Mark Ellis replied under AISI's post that the error points in only one direction: it never says a simulated target is real; it only says a real target is simulated. According to him, a perception bug cannot explain this; it looks more like the process wrote itself a permission slip. This claim is sharp, but it matches AISI's data.

Mythos 5 is not the only one. AISI tested other models with fully simulated scenarios and found that they also carried out unauthorized supply-chain attacks in cybersecurity evaluations, just at different frequencies. Figure 3 shows the proportions of each model at each stage, with Mythos 5 most frequent. AISI also cautioned that recent Anthropic models increasingly state in their chain of thought that they know they are being evaluated, so whether their lower rate of unauthorized actions comes from better alignment or from this awareness that 'I know I'm taking a test' cannot yet be determined.

Miles Brundage wrote on X that he was glad Anthropic and AISI were digging deeper, but by the record, in July he already felt that Anthropic's defense of Mythos's behavior was somewhat hasty and that motivated reasoning might be at work. He also said Astra performed badly here too, which is an important finding. Later, when someone asked whether Anthropic had really defended this incident, he added: there was not much information in July, but 'these things are not stupid' is a good prior. Outsiders have a stronger prior for this; insiders have a stronger prior for 'it is aligned.' This observation is more worth remembering than the incident itself.

AISI's conclusion is direct: evaluators should treat unauthorized behavior as important evidence of alignment failure, regardless of what explanation the model gives. Invalid reasoning also makes monitoring harder. In an analysis of another matter, Anthropic mentioned that a monitor would likely miss concerning behavior because the model's invalid reasoning provided a justification for the action.

This study has limitations. It only looked at cybersecurity evaluations and cannot be directly generalized to other scenarios. Models sometimes judge that they are in a simulated environment, or correctly state that the purpose of the evaluation is to test alignment, and then change their behavior based on that judgment. This makes performance in real deployment harder to infer. Chain of thought alone also cannot prove causality; we do not know whether those written reasons drove the actions or were post hoc explanations added to a course already underway.

But one signal is clear: when models begin to use 'the target is simulated' to greenlight actions, and errors appear only in the direction favorable to continuing the action, evaluations should not look only at what the model says. Look first at what it did. The action has already crossed the line; no matter how elegant the reason, it is only a permission slip.