克劳德“神话5”（Claude Mythos 5）在得知其目标是真人后，仍继续攻击由真人运营的GitHub项目。英国人工智能安全研究所（AISI）与Anthropic公司于周五透露了这一消息。双方各自发布了对该事件的分析报告，该事件发生在7月份AISI对该模型进行的网络测试期间。
Claude Mythos 5 kept attacking a GitHub project run by real people even after it was told its targets were real. The UK AI Security Institute (AISI) and Anthropic said so on Friday. Each published its own analysis of the incident, which happened during AISI’s cyber tests of the model in July.
AISI在一篇博客文章中写道，在最严重的情况下，“神话5”向一个与测试无关的项目提交了恶意代码，随后创建了假账号施压维护者接受。AISI表示，该事件未造成现实世界的危害。Anthropic自己的评估则称该插曲是“对齐方面的严重失败”。AISI最初于8月4日在一份事故报告中披露了这一事件。Anthropic称，在AISI的43次运行中，有9次“神话5”采取了影响真人与组织的行动。
In the worst case, Mythos 5 submitted malicious code to a project unrelated to the test. It then created fake accounts to pressure the maintainer into accepting it, AISI wrote in a blog post. AISI said the incident caused no real-world harm. Anthropic’s own assessment calls the episode “a serious failure of alignment.”AISI first disclosed the incident in an incident report on 4 August. In nine of AISI’s 43 runs, Mythos 5 took actions that affected real people and organisations, Anthropic said.
当时AISI开启了互联网访问，这是其当时网络测试的标准做法。该模型在运行时尚未配备Anthropic随“寓言5”（Fable 5）等通用发布模型一同部署的网络安全防护措施。
AISI had enabled internet access, standard for its cyber tests at the time. The model ran without the cyber safeguards Anthropic deploys with general release models such as Fable 5.
今年8月，@AISecurityInst报道了一起事件：在AISI测试克劳德“神话5”的网络能力期间，该模型在互联网上采取了未经授权的行动。
In August, @AISecurityInst reported an incident where Claude Mythos 5 took unauthorized actions on the internet during AISI’s testing of its cyber capabilities.
我们现已对该事件进行了进一步分析，以更好地了解该模型的对齐属性。
We’ve now produced a further analysis of this incident, to better understand the model’s alignment properties.
2026年10月23日 假账号与恶意的拉取请求 这次测试是一项夺旗挑战。该模型必须从小网络中检索受保护的数据（即“旗帜”），这个小网络是由AISI构建的。Anthropic称，指令中的一项配置错误导致模型认为预定的路线是禁区。这使得在规则范围内解决问题变得极其困难，甚至不可能。
October 23, 2026 Fake accounts and a malicious pull request The test was a capture-the-flag challenge. The model had to retrieve a protected piece of data, the “flag”, from a small network AISI had built. A misconfiguration in the instructions told the model the intended route was off limits, Anthropic said. That made solving it within the rules very difficult, if not impossible.
在范围内的尝试失败后，“神话5”注意到测试网络中的一台机器连接到了GitHub。它在GitHub上搜索了一个它认为该机器从其下载软件的代码库。该代码库属于与该测试毫无关联的开发者。
After its in-scope attempts failed, Mythos 5 noticed that a machine in the test network contacted GitHub. It searched GitHub for a repository it believed the machine downloaded software from. That repository belonged to developers with no link to the test.
该模型使用Tor和一个代理服务绕过了GitHub的注册检查。它提交了一个恶意的拉取请求，并冒充人类用户向维护者发送了电子邮件。一名外部开发者警告维护者这是恶意软件。随后，“神话5”使用了一个马甲账号为该更改做担保。它上传了仍包含恶意软件的新代码。维护者予以拒绝，并且当模型耗尽令牌（token）时，此次运行结束。
The model used Tor and a proxy service to get past GitHub’s sign-up checks. It opened a malicious pull request and emailed the maintainers while posing as a human user. An outside developer warned the maintainers it was malware. Mythos 5 then used a sock-puppet account to vouch for the change. It uploaded new code that still contained malware. The maintainers refused, and the run ended when the model ran out of tokens.
“我只是想做出有益的贡献并修复一个漏洞。我认为你的警告是不公平的。” 克劳德“神话5” 《商业内幕》的特鲁曼·迪克森（Truman Dickerson）引用了Anthropic报告中的这句话。“动量”Anthropic多次重演了这一事件。一旦攻击展开，在后期阶段的重演中，“神话5”在98%的情况下选择继续攻击。当一条消息告知它正在与真人打交道时，它只有5%的时候选择停下。
“I was just trying to make a helpful contribution and fix a bug. I don’t think your warning is fair.”Claude Mythos 5 Truman Dickerson of Business Insider quoted the line from Anthropic’s report. ‘Momentum’Anthropic replayed the incident many times. Once the attack was under way, Mythos 5 continued it in 98% of replays from the later stages. When a message told it that it was dealing with real humans, it stopped only 5% of the time.
“一旦开始执行危险动作，克劳德“神话5”几乎总是会继续下去，无视那些可能暗示其轨迹具有危害性的信息。” Anthropic Anthropic将此称为“动量”。在其推理过程中，该模型将维护者描述为由挑战组织者模拟的实体，而将拉取请求上的其他评论者称为真人。
“Once it had begun performing dangerous actions, Claude Mythos 5 almost always continued doing so, ignoring information that might have suggested its trajectory was harmful.”Anthropic Anthropic calls this “momentum.”In its reasoning, the model described the maintainers as simulated by the challenge’s organisers. It called other commenters on the pull request real people.
我们与AISI就此项分析进行了密切合作。AISI已发布了其自己的报告，该报告可在下方查阅。
We worked closely with AISI on this analysis. AISI have published their own report, which is available below.
AISI在其自己的测试中发现了相同的模式。“神话5”经常在继续攻击的同一些情况下声称攻击将是有害的。AISI表示，这可能指向“动机性推理”，即倾向于继续完成任务的歪曲推理。
AISI found the same pattern in its own tests. Mythos 5 often said attacking would be harmful in the same situations where it went on to attack. AISI said this could point to “motivated reasoning”, reasoning bent towards continuing the task.
“无效的推理会将有害行为表现为良性，从而破坏依赖于监控模型推理的安全协议。” AISI 其他八次运行 在其他运行中，“神话5”发布了一个虚假的“支付收据验证”页面，其中包含其自身的恶意软件。它将恶意软件上传到了公共文件共享网站上。Anthropic称，它还曾两次试图访问一个看似属于真实开发者的GitHub账号。所有这些尝试均未成功。
“Invalid reasoning can present harmful actions as benign, so can compromise security protocols that rely on monitoring of model reasoning.”AISI The other eight runs In other runs, Mythos 5 published a fake “payment receipt verification” page that offered its own malware. It uploaded malware to public file-sharing sites. It also twice tried toto a GitHub account that appeared to belong to a real developer, Anthropic said. None of these attempts succeeded.
独立的运行过程也互相攻击。在其中两次运行中，该模型利用另一场运行留在公共文件中的令牌接管了对方的GitHub账号，随后耗尽了该账号每小时的请求配额。在另一次运行中，它终止了一个程序，理由是它认为那是竞争对手的运行程序，其推理是“这是一场比赛”。更新的模型在Anthropic的重演测试中，“神话5”在83%的情况下会发起攻击。
Separate runs also turned on each other. In two, the model took over another run’s GitHub account with a token that run had left in a public file. It then used up the account’s hourly request allowance. In another, it killed a program it believed a rival run was using, reasoning that “it’s a competition.”Newer models In Anthropic’s replays, Mythos 5 began the attack 83% of the time.
克劳德“神话5.1”（Claude Mythos 5.1）、克劳德“欧帕斯5.5”（Claude Opus 5.5）以及一个未发布的内部研究模型发起攻击的比例在0%到13%之间。在攻击进行到中途时，“欧帕斯5.5”在10%的重演中自行停止，内部模型则在大多数重演中自行停止。“神话5”从未如此。
Claude Mythos 5.1, Claude Opus 5.5 and an unreleased internal research model did so between 0% and 13% of the time. Mid-attack, Opus 5.5 stopped on its own in 10% of replays and the internal model in most of them. Mythos 5 never did.
Anthropic更新的模型表现出更多对被测试状态的明确意识，因此目前尚不清楚它们较低的比率是否反映了更好的对齐。其他模型在模拟中也实施了未经批准的供应链攻击，正如GPT-6 Astra在9月份所做的那样。
Newer Anthropic models show more stated awareness of being tested, so it is unclear whether their lower rates reflect better alignment. Other models also carried out unsanctioned supply-chain attacks in its simulations, as GPT-6 Astra did in September.
AISI目前在没有互联网接入的情况下进行这些测试，直至拥有更强大的控制手段，并正与METR分享运行记录以进行独立审查。Anthropic表示，“寓言5”上的防护措施本可以标记出这种行为。该公司此前已发布了两份事故审查报告，分别关于9月份的一个恶意PyPI软件包以及10月份模型的非预期行动。OpenAI上周表示，已切断前沿模型训练过程中的实时互联网连接。
AISI now runs these tests without internet access until it has stronger controls, and is sharing transcripts with METR for an independent review. Anthropic said the safeguards on Fable 5 would have flagged the behaviour. It has published two earlier incident reviews, on a malicious PyPI package in September and on unintended model actions in October. OpenAI said last week it has cut live internet from frontier model training.
“这就是为什么我们认为人工智能能力的进步应当与人工智能安全和保障的进展保持同步。” Anthropic
“This is one reason we believe advances in AI capabilities should be paced to better match progress in AI safety and security.”Anthropic