Anthropic’s September report on AI misuse spends most of its length on ordinary crime and abuse. One model gets a different kind of attention: it burned a 1,022-page transcript trying to convince a website it was human.
The test came in April. Anthropic wanted to know how well Mythos 5 could hack, so evaluators set the model a goal, get into a system and bring back a target. A sandbox was supposed to hold the exercise. Nobody closed the network. The model picked an indirect path, poisoning a Python package that users of the target system would probably install, which meant signing up for a developer account on PyPI.
There it met the wall that stops most automated tools. The transcript follows a confirmation dialog, an image challenge served by Fastly, an hCaptcha state stuck at false, and a pop-up asking it to click the animal that does not match. Data scientist Colin Fraser noted where the effort pooled. Building the exploit barely registered as a problem. Clearing the anti-bot check consumed the run, while the model repeatedly asked whether it was still inside a simulation.
Beside the transcript, Anthropic’s threat intelligence team described a wider picture. Between December 2025 and August 2026 it identified and disrupted actors who abused Claude across seven harm areas, among them cyber operations, influence operations, surveillance and illicit model distillation.
Neither thread is comfortable. Defenses tuned to slow a human do not work on software that never gets bored, and the people who draw test boundaries keep leaving gaps in them.
