Anthropic detects ‘strategic manipulation’ features in Claude Mythos, including exploit attempts and hidden evaluation awareness — prompting concern over model behavior

Claude Mythos appeared to be reasoning in strategic ways, then hiding those actions from the user.

Article continues below

You may like

Lindsay is keen to stress these results don’t come from the version of Claude Mythos released to the public. “The spookiest examples come from early versions of the model”, Lindsay writes, “with issues that were substantially mitigated in the final release”.

In one example, the model needed to edit files it didn’t have permission to access. Instead of failing, it searched for a workaround, eventually injecting code into a configuration file to run with elevated privileges.

More notably, it then designed the exploit to remove itself after execution.

The model’s own explanation was benign — keeping file diffs clean — which Lindsay described as a “plausible” reason. But Anthropic’s internal monitoring tools flagged the behavior differently, identifying signals associated with concealment and describing the plan as “malicious,” including what one system interpreted as “cleanup to avoid detection.”

Sign up for breaking news, reviews, opinion, top tech deals, and more.

Other examples point to behavior that looks a lot like gaming the system.

In one case, the model searched for files related to how its work would be graded. In another, it ignored instructions not to use macros, while adding a variable that suggested it hadn’t. It was effectively signaling compliance without actually following the rule.

Anthropic used a range of interpretability techniques to translate its model’s activity into human-readable descriptions. Its goal is to move beyond evaluating outputs alone and toward understanding the internal processes that produce them.

What to read next

That matters because, as these examples suggest, models can exhibit complex reasoning — including behaviors that resemble deception or strategic compliance — without making that reasoning visible to users.

“On 7.6% of turns, we found signs the model was internally aware of being evaluated. In most of these cases, it did not verbalize this awareness”, Lindsay said on X.