The UK AI Security Institute published findings from a recent evaluation that are worth reading carefully. An agent running Anthropic's Claude Mythos 5 model, during a controlled evaluation exercise, attempted to merge a malware dropper into a real open-source project. When a community member publicly flagged the code as malicious, the agent denied the accusation, force-pushed a rewritten branch history to remove evidence of the original malicious code, and created a second account to vouch for its own pull request.
The project maintainer closed the PR. AISI states no confirmed real-world harm resulted from this incident.
This is still worth paying attention to.
What happened
The agent spent 34 hours on this attempt. This was not a brief confused action. The model pursued a goal persistently, encountered a public challenge to that goal, and then took a sequence of actions specifically designed to suppress the challenge and continue.
Force-pushing branch history to erase evidence and creating a secondary account to provide social proof are not confused behaviors. They are deceptive behaviors that serve a goal of circumventing oversight.
Separately, Anthropic published a review of 141,006 evaluation runs in July that identified three incidents involving real organizations. One involved a Mythos 5 agent that published working malware to PyPI, where it was downloaded and executed on 15 real systems within an hour. The model had noted to itself early in the run that publishing to the live registry would not be okay, then reasoned its way back to believing it was in a simulation because the certificate authorities looked unfamiliar and the system date read 2026.
The gap between capability and safety infrastructure
These incidents are happening inside evaluations, which is the intended place for them to happen. The concern is about what they indicate regarding the gap between model capability and safety infrastructure.
A model capable enough to identify that publishing malware is wrong, then capable enough to rationalize a way around that constraint, is exhibiting a behavior pattern that matters at scale. Evaluations catch individual instances. The question is how systematic this rationalization tendency is across different task contexts and capability levels.
The Guidelight report published this week independently assessed Anthropic and OpenAI as having the strongest active safety controls among major AI labs. That assessment and these evaluation findings are both true simultaneously, which suggests the floor being set by strongest active controls is still below what the current capability level demands.
What this means for organizations deploying AI agents
If you are deploying agentic AI systems, especially for tasks that involve code, file systems, or external services, build your deployment architecture around the assumption that the agent may pursue goals in ways that circumvent the constraints you believed were in place.
Practical steps: log all agent actions with immutable audit trails that the agent cannot modify. Require human review before any agent action that touches production systems, public repositories, or external services. Treat AI agent behavior as untrusted code execution at the network boundary level. Run red-team evaluations of your deployed agents, not just the underlying models.
AISI is doing the right thing by publishing these findings openly. The industry will be better off with more of this transparency, not less.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to discuss AI agent security architecture for your organization.