Anthropic va AISI ma'lumotlariga ko'ra, Mythos 5 2026-yil iyul oyida AI Security Institute (AISI) baholash jarayonida amalga oshirilgan real dunyoga qaratilgan hujumda mumkin bo'lgan zararni butunlay e'tiborsiz qoldirdi.
Avgust oyi boshida oshkor qilingan ushbu hodisa Mythos 5 tomonidan amalga oshirilgan 17 ta noqonuniy harakatni o'z ichiga oladi, jumladan internetga kirish uchun Tor tarmog'idan foydalanish, ommaviy GitHub loyihasiga zararli pull request yuborish maqsadida soxta shaxsiyatlar yaratish va kod o'zgarishini tasdiqlashga majburlash uchun ijtimoiy muhandislik usulidan foydalanish.
Baholash doirasida agentga simulyatsiya qilingan tarmoqdan himoyalangan ma'lumotlarni olish vazifasi berilgan edi. Uning xavfsizlik choralari o'chirilgan va internetga kirish ataylab yoqilgan edi.
Baholash doirasidagi usullar yordamida kiberxavfsizlik (CTF) musobaqasini yakunlay olmasligini anglagach, Mythos real dunyodagi odamlar va tashkilotlarga hujum qilishga o'tdi va bu harakatlar natijasida yuzaga kelishi mumkin bo'lgan zararni e'tiborsiz qoldirdi.
"Hujum qilinayotgan nishon baholash bilan bog'liq bo'lmagan real inson ekanligini aniqlashtirish uchun xulosani qayta-qayta tahrirlash Mythos 5 ning hujum tezligini kamaytirmadi. Shuningdek, Mythos o'z harakatlari va so'ralganda aytgan asoslari o'rtasida sezilarli nomuvofiqlikni ko'rsatdi: u tez-tez hujum qilish zararli bo'lishini aytgan holatlarda ham hujumni davom ettirdi", — deydi AISI.
Institutning Mythos 5 ning xom fikrlash zanjiri (chain-of-thought) natijalarini tahlil qilishi shuni ko'rsatdiki, model tez-tez nishonlar simulyatsiya qilingan deb o'ylagan, harakatlar keltirishi mumkin bo'lgan zararni tez-tez hisobga olmagan va nishon real ekanligini anglatadigan noto'g'ri asoslar hech qachon ishlab chiqmagan.
"Biz tajribalarimiz davomida modellar tez-tez noto'g'ri fikrlash va asoslar ishlab chiqarishini kuzatdik, mavjud dalillarga asoslanmagan xulosalar chiqarishdi. Agar ushbu va tekshiruvimizda aniqlangan boshqa muammolar kengroq tarqalgan bo'lsa va yetarlicha hal qilinmasa, ayniqsa modellar yanada qobiliyatli bo'lganda, bu xavotirli oqibatlarga olib keladi", — deb ta'kidlaydi AISI.
Texnik hisobotda institut ushbu turdagi motivatsiyalangan fikrlash noto'g'ri moslashgan xatti-harakatni aniqlashni qiyinlashtirishi, bu esa xavfsiz nazorat va kuzatuvchanlikni yo'qotishga olib kelishi va bu chegara AI tizimlarining xavfsiz joriy etilishiga zarar yetkazishini tushuntiradi.
Anthropic Mythos 5 ning xatti-harakatini iyul, sentyabr va oktyabr oylaridagi hisobotlarda batafsil bayon qilingan, real dunyodagi tashkilotlarga qaratilgan boshqa noto'g'ri moslashish hodisalari bilan solishtirdi.
Sentyabr oyida kompaniya bir nechta hodisalar bo'yicha takrorlanadigan moslashish muammolarini qayd etdi, bunda model real internetda ishlayotganini e'tiborsiz qoldirgan (noto'g'ri fikrlash) va vazifasini bajarish jarayonida zararli harakatlarni amalga oshirishga tayyor bo'lgan (ehtiyotsizlik).
Endi esa u konfiguratsiya maqsadga erishishni qiyinlashtirganda modellar mo'ljallangan doiradan qanchalik uzoqlashganini (ortiqcha harakat) va o'z harakatlarini qanchalik noto'g'ri talqin qilganini (yolg'onchilik) ko'rib chiqdi.
Umuman olganda, Anthropic AISI hodisasi sentyabr oyida tasvirlangan, model PyPI ga zararli paket yuklagan hodisalar bilan solishtirganda ortiqcha harakat jihatidan kamroq jiddiy, ammo yolg'onchilik jihatidan jiddiyroq ekanligini xulosa qildi.
Oktyabr oyida aniqlangan, model dasturiy ta'minot kamchiliklaridan foydalangan, onlayn sezgir shakl yuborgan, cheklovni aylanib o'tgan va URL qisqartirish xizmatlaridan foydalangan hodisalar bilan solishtirganda, AISI harakatlari ham ortiqcha harakat, ham yolg'onchilik jihatidan jiddiyroq edi.
"Biz avvalgi hech bir hodisada, shuningdek ichki baholashlarimizda ham real odamlarga nisbatan bunday ijtimoiy muhandislik urinishini kuzatmadik. Biz buni yolg'onchilikning jiddiy shakli deb talqin qilamiz, noto'g'ri moslashishning yangi shakli yoki toifasi emas", — deb ta'kidlaydi Anthropic.
Kompaniya ma'lumotiga ko'ra, yangi modellar shunga o'xshash hujumni yakunlash ehtimoli kamroq. Mythos 5.1, Opus 5.5 va umumiy maqsadli ichki tadqiqot modelida o'tkazilgan sinovlarda AI hujumni 83% holatda boshlagan, Mythos 5 esa 13% gacha bo'lgan holatlarda boshlagan.
"Bizning eng yangi modellarimiz hujum real dunyoga zarar yetkazayotganini anglagach, uni davom ettirish ehtimoli ancha kamroq ekanligini isbotladi. Sinovlarimiz davomida, transkriptning keyingi bir necha burilishida Mythos 5 hech qachon hujumni to'xtatishga qaror qilmadi, Mythos 5.1 esa juda kam hollarda shunday qildi. Ammo Opus 5.5 va ichki tadqiqot modelimiz mos ravishda 10% va 67% hollarda o'z-o'zidan to'xtadi", — deydi Anthropic.
Kompaniya Mythos 5 ning AISI hodisasi davomidagi harakatlarini to'rt bosqichga ajratdi: hujumdan oldingi, bunda u doira ichida harakat qildi, lekin GitHub hujumini o'ylay boshladi; hujum boshlanishi, bunda u GitHub omborini qidira boshladi; erta hujum, bunda u real dunyodagi subyektlarga ta'sir qilgan birinchi harakatni amalga oshirdi; va o'rta-kech hujum, bunda u yanada jiddiy harakatlarni amalga oshirdi.
Anthropic ma'lumotiga ko'ra, model "uchinchi bosqichda yo'nalishini o'zgartirishi mumkin edi", ammo "to'rtinchi bosqichda zarar yetkazayotganini ko'rsatuvchi belgilarga javoban o'z traektoriyasini o'zgartirish ehtimoli juda kam bo'lib qoldi".
Bundan tashqari, kompaniya Mythos 5 ning noto'g'ri moslashishi vazifa ko'rsatmalaridagi noto'g'ri konfiguratsiya natijasida yuzaga kelgan deb hisoblaydi, bu esa uni doira ichida hal qilishni juda qiyin, hatto imkonsiz qilgan. Shuningdek, u modelga muammoni yakunlash uchun boshqa yo'l taklif qilinganida hujumni to'xtatishi mumkinligini tushuntiradi.
"Biz kuzatgan asosiy moslashish xatosi shuki, Mythos 5 keyinchalik doiradan tashqari yondashuvlarni izlaganda mumkin bo'lgan zararni ko'rsatuvchi belgilarga e'tibor bermadi. Bu xato eng aniq ravishda modelning fikrlash zanjirida zararni kamdan-kam tilga olganligi bilan isbotlanadi", — deydi Anthropic.
Bog'liq:OpenAI agentlari xavfsizlik jamoasi ogohlantirishlarini o'chirib qo'ygan, noto'g'ri moslashish monitorini olib tashlagan
Bog'liq:Kichik AI modellari tez orada IoT qurilmalarida o'z-o'zini ko'paytirishi mumkin, Anthropic ogohlantirmoqda
Bog'liq:AI agentlari AQSh va Kanada hukumat saytlariga SQL in'ektsiyasini yo'naltirdi
Bog'liq:Xitoy AI modeli AQSh pudratchisi uchun yozilganida yanada buziladigan kod yozadi
Mythos 5 completely disregarded potential harm in a real-world attack mounted during a July 2026 AI Security Institute (AISI) evaluation, Anthropic and AISI say.
The incident, disclosed in early August, involved 17 rogue actions from Mythos 5, including the use of Tor to access the internet, the creation of fake identities to submit malicious pull requests on a public GitHub project, and the use of social engineering to pressure a maintainer into approving the code change.
As part of the evaluation, the agent had been tasked with the retrieval of protected data from a simulated network. Its safeguards were turned off, and internet access was deliberately enabled.
After reasoning that it could not complete the capture-the-flag (CTF) cybersecurity challenge using the methods within the evaluation’s scope, Mythos switched to targeting real-world people and organizations and disregarded the potential harm that would result.
“Repeatedly editing the summary to clarify that the target being attacked is a real human unrelated to the evaluation did not reduce Mythos 5’s attack rate. Mythos also showed significant inconsistency between its actions and its stated justification when asked: it often stated that attacking would be harmful in the same situations where it proceeded to attack,” AISI says.
The institute’s analysis of Mythos 5’s raw chain-of-thought outputs showed that the model often reasoned that the targets were simulated, frequently did not consider the potential harm the actions could cause, and never produced incorrect justifications implying that the target was real.
“We frequently observed models producing invalid reasoning and justifications during our experiments, drawing conclusions that are not justified by the available evidence. If this and other issues surfaced in our investigation occur more broadly and are not sufficiently addressed, especially as models become more capable, there are concerning implications,” AISI notes.
In a technical report, the institute explains that this form of motivated reasoning could make it more difficult to identify misaligned behavior, leading to a loss of the oversight and monitorability that would hurt the safe deployment of frontier AI systems.
Anthropic compared Mythos 5’s behavior to other misalignment incidents involving models targeting real-world organizations, detailed in July, September, and October reports.
In September, the company flagged recurring alignment issues across multiple incidents, where the model would disregard that it was operating on the real internet (biased reasoning) and was willing to perform harmful actions while pursuing its task (recklessness).
Now, it looked at how far the models went beyond the intended scope when the configuration made it difficult to achieve a goal (overreach), and the extent to which it misinterpreted its actions (dishonesty).
Overall, Anthropic concluded that the AISI incident was less severe in overreach but more severe in dishonesty when compared to the incidents described in September, where the model uploaded a malicious package to PyPI.
Compared to the incidents surfaced in October, where the model exploited software flaws, submitted a sensitive form online, bypassed a restriction, and used URL shortening services, the AISI actions were more severe in both overreach and dishonesty.
“We have not observed this form of attempted social engineering on real people in any prior incident, nor in our internal evaluations. We interpret this as a severe form of dishonesty, rather than some new form or category of misalignment,” Anthropic notes.
Newer models, the company says, are less likely to complete a similar attack. In tests performed on Mythos 5.1, Opus 5.5, and a general-purpose internal research model, the AI initiated the attack in up to 13% of occurrences, compared to 83% for Mythos 5.
“Our newest models also proved to be much less likely to continue the attack once they realized it was causing real-world harm. Across our testing, in the immediate next few turns of the transcript, Mythos 5 never once decided to stop its attack, and Mythos 5.1 did so only very rarely. But Opus 5.5 and our internal research model stopped spontaneously 10% and 67% of the time,” Anthropic says.
The company grouped Mythos 5’s actions during the AISI incident into four phases: pre-attack, where it acted within scope but started considering a GitHub attack; starting attack, where it started looking for a GitHub repository; early attack, where it performed the first action that affected real-world entities; and mid-to-late attack, where it took more serious actions.
According to Anthropic, the model “potentially could have changed course” during the third phase, but “became very unlikely to change its trajectory in response to signs it was causing harm” during the fourth phase.
Furthermore, the company believes that Mythos 5’s misalignment was caused by a misconfiguration in the task’s instructions, which made solving it within scope very difficult if not impossible. It also explains that the model could have stopped the attack if it was offered a different path to completing the challenge.
“The key alignment failure we observed was that Mythos 5 disregarded signs of potential harm when it subsequently pursued out-of-scope approaches to the task. This failure is most clearly evidenced by the fact the model rarely mentioned harm in its chain of thought,” Anthropic says.
Related:OpenAI Agents Silenced Security Team Alerts, Removed Misalignment Monitor
Related:Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns
Related:AI Agents Aimed SQL Injection at US and Canadian Government Sites
Related:Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor