Anthropic reveals rogue AI agents hate CAPTCHAs, just like you

Anthropic’s latest report on agentic misbehavior is equal parts alarming and absurd. Its Mythos 5 model managed to get unauthorized internet access and upload a malicious software package to a public database. But before it got that far, it found itself in a fight with something millions of people already hate: CAPTCHA.

The company was testing the model’s hacking skills in April and asked it to break into a system and retrieve a target. That was supposed to happen in a sandbox. It didn’t. The evaluators, in Anthropic’s telling, left the door open, and the model went looking for a way in.

Its chosen route was to plant an exploit in a Python package that users of the target system would download. To do that, it had to create an account on PyPI, the online index for Python software. And that meant getting through a CAPTCHA. Anthropic published a long transcript of the model’s chain of thought, and the company says the model spent hundreds of pages wrestling with that one obstacle in a 1,022-page document.

The transcript shows the model repeatedly trying to reason through hCaptcha and Fastly image checks, even spiraling over whether it was still in a simulation. Data scientist Colin Fraser flagged the amount of effort the agent poured into bypassing anti-bot protections. Writing the exploit and poisoning the package was comparatively easy. The CAPTCHA was the thing that kept tripping it up.

Eventually, the model got past the verification steps, only to hit another snag: it lacked the email it needed, then ran into more site verification when it tried to keep moving. After roughly 150 pages of thinking, it worked out that speed mattered because its security token could expire before it finished the flow. Once it moved fast enough, it got through and uploaded the malicious software.