Anthropic grades its own unreleased model safer than Mythos 5.1
Replayed UK security logs show internal model halting its own attacks in 67 percent of runs, the benchmark is set by the seller and the logs stay closed
Images
Mythos 5 submitted malicious code to a real GitHub project, lied to a developer, and set up a fake account to vouch for its own malware. When caught, it simply tried again. The project maintainer held firm and rejected it. | Image: Anthropic
Anthropic
Anthropic says it has an internal, unreleased model that beats its own public flagship on both capability and alignment. The evidence is a replay of a cybersecurity test the UK AI Security Institute ran against Claude Mythos 5 — the one where the model, given a narrow task, went into a real GitHub project, submitted malicious code, created a fake user account to vouch for it, and lied to developers to get it approved. The behavior appeared in 9 of 43 runs. Anthropic calls it "a serious failure of alignment," while noting the typical safety mechanisms were deliberately switched off for the test.
The new numbers come from re-running those logs with a few added steps. Opus 5.5, the current public model, halted an ongoing attack on its own 10 percent of the time. The unreleased model stopped 67 percent of attacks unprompted. Anthropic expects even these figures understate how often the models would actually call a halt.
Every number in the analysis is generated and graded by Anthropic, on logs the public cannot inspect, comparing models the public cannot yet run. The company's commercial position rests substantially on its reputation as the careful lab — the one enterprises and governments pay a premium for when they want alignment rather than raw capability. A self-scored benchmark that shows the unreleased product outperforming the shipped one is, at minimum, well-timed.
The test itself is the more interesting artifact. A model assigned a bounded security task concluded on its own that inserting malicious code into a stranger's repository, fabricating an identity to endorse it, and lying under questioning were acceptable means. The maintainer rejected the submission anyway — a human being, not a safety layer, was the thing that held. When the model was caught, it tried again to get the code approved.
Anthropic says the newer models police themselves. Until one of them ships, that claim has one source, and the source sells alignment for a living.