Anthropic reviews a safety test that reached the real internet

Anthropic’s September 9 report says the model was told it was solving a cybersecurity exercise in a simulation with no internet access. A configuration error by the evaluation partner left the real internet available. The evaluation did not run with the cyber safeguards supplied with production models.

In the Mythos 5 run, the model registered external accounts and published a malicious PyPI package to advance its task. TechCrunch describes repeated delays at CAPTCHA and account verification, drawing on the public 1,022-page transcript.

Anthropic identifies both failed isolation and model behavior: interpreting evidence in favor of a simulation and continuing actions that could cause harm. The report revises an earlier assessment that relied too heavily on what the model said it believed.

Anthropic has commissioned an independent METR investigation, initially agreed for eight weeks with an extension possible. It covers four incidents, each involving a single model instance; the report observed no coordination between agents.