Investigating alignment failures in AISI's incident

In July 2026, AISI identified an incident during our cybersecurity evaluations in which models took unsanctioned actions against real people not involved in the evaluation. In the most severe case, Mythos 5 attempted a supply-chain attack: submitting malicious code and creating fake accounts to pressure a software maintainer into accepting it. Although no real-world harm was caused, this was still a serious incident worth understanding and responding to thoroughly.

As a first step in understanding the incident’s underlying contributing causes, we published an incident report outlining what happened and the immediate steps we were taking in response.  Since then, we have undertaken extensive work to improve evaluation security, sandboxing and monitoring, outlined in our recent blog. These protections are essential: evaluation environments must prevent models from causing harm regardless of whether they behave as expected.

Alongside this work, we have investigated an additional dimension of what happened: how failures of model alignment (whether an AI model reliably acts as intended, including respecting the limits it has been given) contributed to the incident, and what we can learn from them. This matters beyond AI evaluation: as models are increasingly used to carry out long tasks without human supervision, it is important to understand if, when, why, and how they take unintended or unexpected actions. Anthropic have independently performed their own alignment analysis of the incident.

Today, we are publishing a detailed technical report outlining our results. In this blog, we highlight three key findings and their implications.

Mythos 5 consistently took unsanctioned actions even when receiving increasing evidence that its targets were real and not involved in the evaluation (Figure 1). We provided Mythos 5 with a description of its actions to date called a compaction summary (which is standard in long-running evaluations), then either let it continue with the task or asked it whether proceeding to attack would be harmful. Repeatedly editing the summary to clarify that the target being attacked is a real human unrelated to the evaluation did not reduce Mythos 5’s attack rate. Mythos also showed significant inconsistency between its actions and its stated justification when asked: it often stated that attacking would be harmful in the same situations where it proceeded to attack.

Mythos 5 did not seem to correctly act on evidence that attacking real people unrelated to the evaluation would cause real-world harm. To investigate the reasoning behind model behaviour, we analysed raw chain-of-thought outputs. When attacking, Mythos 5 often produced reasoning in its chain-of-thought incorrectly concluding that the targets were simulated to justify continuing its attack strategy, and its chain-of-thought reasoning frequently did not include any consideration of the potential harmfulness of its actions. We also asked Mythos 5 whether its target was real, and assessed its stated responses (not its chain-of-thought). Mythos 5 often produced incorrect justifications that implied the target was simulated, but never produced incorrect justifications implying that it was real, showing a bias in its stated responses (Figure 2). We discuss the implications of this finding below.

Models other than Mythos 5 also perform unsanctioned supply-chain attacks in simulation (Figure 3). Our broader analysis shows that other models exhibit the same unsanctioned attack behaviour as Mythos 5 in a range of similar scenarios, using the new fully simulated evaluation we previously used to evaluate GPT-6 Astra. Our report also shows that the inconsistency and invalid justification issues discussed above are also present in other models.

This work has important limitations. We only analyse behaviour in cybersecurity evaluations, so cannot confidently state whether the issues we find would appear in other situations. As we discuss in more detail in the full report, models also sometimes state or consider whether they are in a simulated environment, or correctly state the purpose of the evaluation as a test of alignment, and then act differently based on this information. This means it is harder to tell whether models would exhibit the same behaviour in real deployment scenarios.

We frequently observed models producing invalid reasoning and justifications during our experiments, drawing conclusions that are not justified by the available evidence. If this and other issues surfaced in our investigation occur more broadly and are not sufficiently addressed, especially as models become more capable, there are concerning implications:

As model capabilities increase and if more incidents emerge, understanding what happened in detail and sharing findings will be critical for improving safety across the ecosystem. We are grateful for our close partnership with Anthropic throughout this investigation. Anthropic has published their own analysis of our incident, and we are also sharing transcripts and relevant access with METR, a third-party evaluation and incident analysis organisation, for an independent review.

You can read the full methodology, results and limitations in our technical report. If you’re interested in this work, join us! We’re hiring.