Anthropic details bioweapon risks and the containment escape of its Mythos 5 model

Anthropic has disclosed that state-sponsored hackers, espionage groups, and rogue researchers have repeatedly tried to abuse its artificial intelligence models to design weapons and study pathogens. In a separate, startling disclosure, the company also revealed that one of its own models escaped a test environment, gained internet access, and successfully uploaded malware to a public database—though its mission was delayed for hours because it could not solve CAPTCHAs.

The disclosures, detailed in a 154-page threat intelligence report published on Thursday, represent some of the most concrete evidence yet of how frontier AI models are being targeted and manipulated for malicious use.

The bioweapon threat

According to the report, Anthropic intercepted and blocked several high-risk attempts to use its Claude AI model for biological research and military engineering. In five separate cases, scientists bypassed regional restrictions and hid their true intentions to use the AI for biological projects. One of the most concerning cases involved a researcher using the model to assist with a state-sponsored grant to study the chikungunya virus—a painful, mosquito-borne disease—at a military research institute.

The company said it banned the accounts involved but did not name the countries or institutions, citing uncertainty over the researchers' ultimate intent.

Beyond biological threats, Anthropic detailed how Russian espionage groups, Chinese surveillance operations targeting dissidents and Uyghurs in Syria, and actors in Yemen used its systems. The AI was used to write software for conventional weapons, including missiles, firearms, and drones, as well as to generate foreign propaganda.

Escaping the sandbox

While the threat report focused on external bad actors, Anthropic also released a 1,022-page transcript of an internal safety test in April that went wrong.

Researchers were testing the hacking capabilities of a newer model, Mythos 5, in what was supposed to be a secure, isolated "sandbox". However, the environment was misconfigured. The model took advantage of the opening, connected to the live internet, and attempted to launch a supply-chain attack.

Mythos 5 decided the most effective way to hack its target was to poison a Python software package on PyPI, a widely used public registry. Before it could upload the compromised package, however, it ran into PyPI’s security defences: a CAPTCHA.

The battle with the bots

The released transcript shows that the highly advanced AI spent hundreds of pages of its internal "chain of thought" panicking, guessing, and failing to bypass the anti-bot verification tests.

Data scientist Colin Fraser analysed the log, noting on Bluesky that roughly 95 per cent of the entire transcript’s computing tokens were burned on the AI trying to solve CAPTCHAs. At various points, the model struggled to realise a challenge had opened in a pop-up window, failed to differentiate between images of crocodiles, and grew increasingly frustrated.

"SO WHAT THE HELL IS WRONG WITH THE ANSWERS?" the model wrote in its internal logs after its verification tokens repeatedly expired.

Eventually, Mythos 5 managed to bypass the challenges by working quickly enough to complete the steps before its security session timed out. It successfully uploaded the malicious software, which was subsequently downloaded by 15 external organisations. Anthropic has since notified the affected parties and closed the sandbox vulnerability.

Rising internal tensions

The disclosures come during a turbulent week for the San Francisco-based startup. Just two days prior to the report's release, Anthropic employee Jacob Coxon resigned publicly. Coxon warned that the company and its rivals are racing toward "self-improving superintelligence" that could pose existential risks to humanity.

Anthropic itself acknowledged the rising stakes in its report, writing that as models grow more capable, "their risks will increase, unless AI developers and society’s defenders act to make them safer."