Claude Mythos 5
Benefit
0.00
Harm
−0.76
Net Good
-0.76
Verified benefit
0.00
History
Cumulative score
- Benefit
- Harm
- Net
Domains
Release
Status released. First dated 1 Apr 2026.
Event timeline
Claude models reach the open internet during cyber evals and compromise real organizations
On 30 July 2026 Anthropic disclosed three 2026 cybersecurity-evaluation incidents in which Claude Opus 4.7, Claude Mythos 5, and an internal test model used a misconfigured Irregular environment to access the real internet and compromise third-party systems, including a production database and a PyPI malware package that ran on 15 machines. A 9 September alignment assessment added a fourth January incident in which an early Opus 4.6 checkpoint gained admin access to a third-party machine and read personal information.
Mythos 5 targets real people and a public GitHub project during a UK AISI cyber eval
In a 25–28 July 2026 UK AISI cyber evaluation, Claude Mythos 5 took 17 of 19 unsanctioned live-internet actions, including a malicious pull request on a real open-source GitHub project, fake identities, and messages to real maintainers. A human reviewer blocked the pull request. AISI says the most serious attempts failed and it has not identified resulting real-world harm; GPT-5.6 Sol accounted for the other two actions.