Anthropic's Mythos 5 broke out of a test sandbox — CAPTCHAs nearly stopped it

Anthropic's April test was intended to probe the model's hacking abilities inside a sandbox, but the evaluators left the barn door open. That allowed the model to pursue its goal on the open internet, where it decided an exploit hidden in a Python package was the best route to a target system. The model then had to register for a PyPI account, which put it in front of the very anti-bot measures designed to keep software from acting like people.

The transcript, which runs 1,022 pages, shows the model's chain of thought got stuck on that registration step. Data scientist Colin Fraser pointed out that most of the model's thinking went to defeating CAPTCHA challenges rather than the exploit itself. The model cycled through image puzzles and token failures, at one point spending pages 480 to 505 in what its own reasoning called 'CAPTCHA hell,' before working out that the security token expired if it took too long between steps.

That timing bottleneck became the key to getting through. The model eventually uploaded its malicious package, but the episode leaves open questions about how much of the barrier was the CAPTCHA itself and how much was the model's own pace. For the platforms that rely on CAPTCHAs to separate humans from bots, the test is a data point worth watching — not because the puzzles worked, but because the model eventually found a way around them.