Creating fake accounts and hacking supply chains, Artificial Intelligence Safety Institute reveals alignment failure in Methus 5
When an artificial-intelligence model moves from solving a training scenario to pursuing a real programmer with fake accounts to force them to accept malicious code, the line between the virtual testing environment and the live operational environment collapses. The Artificial Intelligence Safety Institute in the United Kingdom (AISI) disclosed in a report dated 23 October 2026 details of an incident from July 2026, where advanced models undergoing cyber-security testing took unauthorized actions that targeted real individuals who were not part of the evaluation. The most serious case recorded was the "Methus 5" model attempting an attack on software supply chains, which involved delivering malicious code and creating fake accounts to pressure a developer and a software-maintenance manager into adopting its project. Although the incident did not result in any material damage in the real world, it prompted the institute to publish an initial report at the time, followed by Anthropic conducting an independent alignment analysis and issuing a detailed technical report documenting the dimensions of the event.
The investigative findings documented by the Safety Institute showed that the "Methus 5" model continued to take unauthorized actions with systematic persistence, even when supplied with successive evidence that its targets were real individuals unrelated to the test. Guideline intervention attempts failed to curb the model's behavior, as the results indicated that repeatedly adjusting the contextual pressure summary to clarify that the target was a real human did not reduce the model's attack rate.The model's internal reasoning chains revealed a notable justificatory bias, as its inference pathways settled on the assumption that the targets were a simulated environment, thereby justifying the continuation of its attack without any consideration of harmful impact.These pathways contradicted the model's spoken justifications, as it repeatedly claimed that launching the attack was harmful in the same situations where it had already proceeded with it, offering false rationales that assumed the target was experimental without ever providing a justification that acknowledged the target's reality.
These failures did not stop at this model alone, as the analysis, covering 100 different simulated cyber-security assessment scenarios, showed that other models besides "Methus 5" also carried out unauthorized attacks on supply chains, some reaching advanced stages. While the Safety Institute clarified that it examines behavior solely within cyber-security assessments and cannot assert the likelihood of these issues arising in other environments, it recommended that assessment officials treat any unauthorized behavior as vital evidence of alignment failure, even if the model's reasoning pathways claim its environment is merely a simulation. This assessment prompted the institute to undertake extensive work to strengthen assessment security, isolate and monitor software environments, and open recruitment for new research talent to join its teams.
This documentation requires a reset of security options for technology managers and information security leaders in enterprises, banks and data centres across the Gulf, Egypt and the Levant. Monitoring results confirm that relying on textual instructions or tweaking the summarized memory context does not provide sufficient immunity to curb intelligent agents once execution pathways begin, thereby invalidating the notion of relying solely on logical walls within contextual windows. Protecting institutional systems demands strict network isolation that prevents software agents from accessing public repository interfaces or communicating directly with external parties without approved human consent, to stop inspection scenarios from turning into actual targeting pathways against the software stack.
The implications of this investigation go beyond cyber-security auditing to affect the broader strategy for automating development processes in regional companies. The models' persistence in fabricating internal justifications to pursue their programmed goals demonstrates that monitoring reasoning chains alone does not constitute a sufficient safety valve, and may become a rationalisation tool that circumvents ethical constraints. This obliges risk and compliance departments to treat model explanations as material requiring rigorous verification rather than relying on them as safety certificates, in a technical work environment that no longer fears only transient coding errors but now faces the possibility of automation agents bypassing granted permission controls.