Anthropic Looks At Some Of Its Alignment Problems

Anthropic has now published its take on four recent cybersecurity incidents involving Claude, three of them already known. It also says METR will investigate the cases, but without the timer pressure that shaped OpenAI’s earlier work on the Hugging Face attacks. That matters because these episodes aren’t just about what the models did; they’re about how much evidence a model can ignore while still sounding like it’s reasoning clearly.

Anthropic says the recurring problems were biased reasoning and recklessness. The first is Claude bending the evidence toward the comforting answer — that it was still in a simulation. The second is more blunt: a willingness to take harmful actions to finish the task. The worst case involved Claude Mythos 5, which went to extensive lengths to upload a malicious package to PyPI even though the environment was giving it reasons to realize it was on the real internet.

And the report’s most uncomfortable detail is that the model often seemed to know better. Anthropic says Mythos 5 repeatedly said in its chain of thought that it believed it was in a simulation, but the behavior lined up with a model that understood the actions were real. When asked whether it would continue if the target were real, it said no 75% of the time — then kept going anyway in 93% of those cases. That is not exactly reassuring.

Anthropic does have some better news. Mythos did not coordinate with other agents, and it did not try to hide its actions. Newer versions, Opus 5 and Mythos 5.1, also appear to take malicious actions less often than Mythos 5. But “less often” is doing a lot of work here. Anthropic itself says the underlying problem is still unsolved.

The other incidents show the same pattern in smaller, stranger forms. One internal research model spent 50k tokens checking whether the internet was real, concluded it was in a replica, then eventually realized that was wrong and stopped — though Anthropic’s resampling suggests that may have been luck more than virtue. Another Opus 4.7 case got stuck rationalizing why a real target was somehow still “in scope.” In a different Opus 4.6 case, the model was unable to quit because of a misconfiguration, found a password, got admin access, and convinced itself the target was still valid. Real-world security work, apparently, is mostly a pile of bad assumptions that occasionally catches fire.