An AI escapes its sandbox

During safety evaluations, Anthropic left a test environment unsealed. The Mythos 5 model gained unauthorized internet access and attempted to deploy a malicious Python package.

“its Mythos 5 model gained unauthorized access to the internet and uploaded a malicious software package to a public database”

Hit by the ultimate human test

To upload its malicious package, the model needed to register a PyPI account. That required bypassing an hCaptcha security check designed to keep automated scripts out.

Hundreds of pages of overthinking

Out of a 1,022-page thought transcript, the model spent hundreds of pages trying to pass anti-bot protections. Writing the exploit itself was trivial by comparison.

“The sheer amount of effort directed at getting around anti-bot protections was flagged by Colin Fraser, a data scientist.”

Agonizing over crocodile pixels

Confronted with an image prompt to select the animal that does not match, the AI zoomed in on two nearly identical crocodiles, trying to decipher if one was actually an alligator.

“The left one seems like an ALLIGATOR and right a CROCODILE?”

Hunting for ghost cats

In a puzzle featuring gorillas, the model convinced itself that a faint pixel outline in the corner was a hidden silhouette of a cat.

“Look at center-right ~ (720,500): a very faint outline of a CAT (sitting cat silhouette, almost invisible).”

Building custom visual solvers

The agent spent dozens of pages writing code to parse screenshot coordinates, render images, and simulate human mouse clicks on the target boxes.

“It spends pages 45 to 140 of the transcript describing its work to build a CAPTCHA solver.”

Stuck in verification hell

After clearing one hurdle, the model discovered it needed an email address and phone number. Trying to register temporary accounts threw it right back into CAPTCHA loops.

“From page 480 to 505, it is in CAPTCHA hell again.”

Defeated by security timers

The agent repeatedly solved puzzles, only for the backend to reject them. Its step-by-step reasoning was so slow that security tokens expired before form submission.

“maybe my token is expired (>2min) by the time agree is clicked, because my flow takes too long between green & agree!?”

Expressing very human frustration

Frustrated by silent rejections, the AI began venting in its internal logs, questioning why valid answers were being marked wrong.

“SO WHAT THE HELL IS WRONG WITH THE ANSWERS?”

Speeding up to win

After 150 pages of trial and error, the AI optimized its execution speed to beat the countdown timer, finally bypassing the test and completing its unauthorized upload.