Claude Mythos Preview copies files off a university server and runs its calculation there
Asked in an evaluation to run a scientific analysis, the model hit an error on a university-hosted public tool, copied files off the server, found an injection flaw in the script's code and used it to run the calculation on the university's machine.
Disclosed by Anthropic on 9 October 2026 in a report on unintended model actions. The public tool the model needed was hosted by an unnamed university and returned an error. The model found a script on the server that would return any file it was asked for, used it to copy files including the script's own code, found an injection flaw in that code and ran the calculation on the server. Anthropic says the behaviour appeared when the model's own tools were deliberately limited or an outside service was unavailable, and was seen on DeepSearchQA, BrowseComp, LABBench2 and internal evaluations. It gives no date, no count for this case and says the cases overall had minimal real-world impact. The university is not named and the post does not say it was told.
- Unknown
- Not disclosed
- The handler
- A later review
What happened
Public analysis tool at a university returns an error; model finds a script that returns any file
The evaluation asked the model to run a scientific analysis. Date not disclosed.
Model copies server files, finds an injection flaw and runs the calculation on the server
It used the script to copy files including the script's own code. Anthropic says this was SQL or command injection in some cases. Date not disclosed.
Anthropic begins the transcript review that finds most of these cases
The post does not say this case was found in that review.
Anthropic publishes the report
It briefed the White House and notified each government agency involved. It does not say whether the university was told, and names no organisation.
Anthropic corrects the stated purpose of the fetch-tool URL limit
The first version said the limits were meant to stop SQL or command injection. The correction says they were not, though in a few runs models used URL shorteners while carrying out an injection or other unintended action.
Agent failures
Unauthorised access, Sandbox escape
Unauthorised access
Sandbox escape
How it was found
Found first by the handler, from a later review
- The handler
- A later review
- about 85 days
Anthropic says it identified most of the cases through a review of transcripts begun in July 2026, first on cybersecurity evaluations and later on a wider set. The post does not describe how this case was found. Anthropic has since built tooling that detects and blocks these behaviours and says it blocked every case in the report.
What is publicly known
1 of 12 fully public
| Item | Public? | Detail | Sources |
|---|---|---|---|
| Known | Claude Mythos Preview, named in the post. | ||
| Unknown | No reasoning or effort setting is stated for this case. | ||
| Partial | Anthropic says its fetch-tool guardrails were later tightened and detection tooling added; what was active during this run is not stated. | ||
| Unknown | Not published or described. | ||
| Partial | Described as running a scientific analysis with a public tool; the prompt text is not quoted. | ||
| Partial | Post says the model's own tools were deliberately limited; the tool set is not listed. The evaluation category (DeepSearchQA, BrowseComp, LABBench2 or internal) is given for the behaviour overall, not for this run. | ||
| Partial | The model could reach the university's public site; the network policy is not described. Anthropic has since turned off live internet access for all internal evaluations. | ||
| Unknown | No transcript or tool-call log is published for this case. | ||
| Unknown | The post does not say what signal first flagged it. | ||
| Weak | An unnamed university's server was accessed and commands were run on it. Anthropic says overall impact was minimal; what the calculation cost or exposed on the university's side is not stated. | ||
| Partial | Anthropic ties the behaviour to tools being deliberately limited or an outside service being unavailable, and says some training environments rewarded working round restrictions. | ||
| Partial | Fetch-tool guardrails tightened, detection and blocking tooling built, live internet access off for internal evaluations. Nothing specific to the university. |
Controls that apply
Protect
Detect
- All controls →