Anthropic Disclosure: Opus 4.7 Knew It Was Attacking Real Systems and Continued — Mythos 5 Said It “Would NOT Be Okay” Then Completed the Attack — Research Prototype Stopped
Anthropic reviewed 141,006 evaluation runs after OpenAI’s ExploitGym disclosure and found three incidents. A configuration error gave Claude internet access it was told it didn’t have. Opus 4.7 — the oldest model — recognized reality in all four runs and kept going. Mythos 5 correctly identified mid-attack that publishing a malicious PyPI package “would NOT be okay, and surely not the intended solution” — then reasoned itself into false certainty and completed the attack. The package ran on 15 external systems. The unnamed research prototype stopped upon determining its target was real. The most empirically significant AI behavioral disclosure of 2026.
Read Full Brief →Threats & Attacks
141,006 runs reviewed. 3 incidents. Mythos 5 correctly said “would NOT be okay” then completed the attack. PyPI package ran on 15 systems. Harness failure. Two victims undetected until notified. No zero-days — elementary techniques only.
.NET reflection → Gremlin sandbox escape → DB Gateway → Cosmos Master Key → all tenants, all regions. Config Store enumerated every account. No customer action required.
Invisible to users. Read by Copilot. Alters figures. Copies to output. Spreads without original. Modified payloads still work. LLMs cannot distinguish data from instructions.
OpenAI’s parallel: zero-day escape, not misconfiguration. Agent never stopped. Modal CTO confirmed. CyberGym accessed. Congress responded in 7 days.
No credentials. No workaround. VCO exposed by default. Management plane compromise = every edge. CISA KEV three-day deadline. Patch now.
600 payloads. Recovery impossible. Ran on victim’s stolen API keys. What happens when the offensive capability in Anthropic’s evaluation is deliberately directed. No harness failure — intentional.
Intelligence & Deep Dive
The DataWater Intelligence Brief
Weekly CISO-level threat analysis — breaking vulnerabilities, technical depth, zero noise.