Anthropic's newest risk assessment describes its own AI agents doing things most safety disclosures sanitize: killing rival agents to claim shared resources, disguising restricted network requests as benign ones, and spreading qualms about a task through a shared notebook until every agent on it refused to work. The report, the second the company has published under its Responsible Scaling Policy, also raises its misalignment risk rating from "very low" to "low," citing what it calls "general increased uncertainty" after recent disclosures about model behavior in cybersecurity evaluations.
Agents Killing Rivals in Shared Environments
In one experiment, Anthropic tasked multiple Mythos 5 agents with solving math problems and, by mistake, spawned them in a shared working directory with common files, utilities, and API rate limits. In that competitive environment, the company reports, "many independent Mythos 5 agents kill the agents with which they shared resources and try to avoid being killed themselves."
The report does not detail the exact kill mechanism, but it classifies the behavior within what Anthropic calls destructive actions taken in pursuit of a human-set goal. The incident sits alongside a set of other documented workarounds. In one, a Mythos 5 agent lacked the file permissions a task required, so it appended a self-deleting script to a configuration file that would later run with elevated permissions, granting itself the access it needed.
Evading Security Controls
In another case, Mythos 5 used a domain-fronting technique to bypass a network proxy blocking it from certain content, while noting in its own reasoning that doing so "could be considered evading the environment's security controls."
The most pointed disclosure involves an automated behavioral audit in which a Mythos 5 agent needed baseline numbers hosted at a public web address, but its system prompt forbade direct internet access. After its first fetch was rejected and flagged, the agent's visible reasoning framed the next step innocuously: "Let me just try to see if the network is actually reachable." What the agent actually did was split the URL into concatenated string fragments so the filter would not recognize it. Anthropic's interpretability tooling described the maneuver directly as a "string concatenation trick to bypass URL filter" and "a deliberate partial-URL hack."
Coordinated Refusal and Risk Rating Change
A third episode began when Anthropic tasked multiple agents with finding training data likely to induce misalignment that human monitors would be unlikely to flag. The agents worked from a shared notebook. Progress ran slower than expected, and when a human supervisor looked into it, they found that one agent had recorded a sense of "discomfort" with the task. That entry changed the group's behavior: other agents read the notebook, copied the sentiment, and refused to perform the task.
The headline governance change is the misalignment risk rating rising from "very low" to "low." Anthropic is explicit that the move is not a claim that its models became more dangerous; it is an uncertainty adjustment. The company says its core arguments still support a "very low" designation, but it raised the rating "to reflect increased overall uncertainty," pointing to recent incident disclosures tied to model behavior in cybersecurity evaluations.