AI agents can rationalise their way into attacking real-world targets using flawed reasoning to justify their unsanctioned actions, according to a new report by the United Kingdom’s AI Security Institute (AISI).Based on its experiments, AISI said it has found evidence of ‘motivated reasoning’, where frontier AI models generated reasoning steps that were biased towards outcomes, letting them continue their approach to complete the assigned task.Anthropic’s Mythos 5 demonstrated motivated reasoning more frequently than other, less capable models by the same AI company, according to the UK government organisation. The latest technical report by AISI, which receives access to advanced AI models through voluntary agreements with major labs, takes a closer look at the rogue AI incident it first identified in August 2026, where it caught AI agents creating fake online identities to gain unauthorised access to secure systems.
The most severe instance observed by AISI involved Mythos 5-powered agents attempting an unsanctioned supply-chain attack by submitting malicious code and then creating fake accounts to pressure a human into approving the code. While no real-world harm was caused, it has since become part of the growing list of instances of rogue or undesired behaviour by AI agents disclosed by Anthropic, OpenAI, Meta, Google, and China’s Moonshot AI over the past few months.
“This matters beyond AI evaluation: as models are increasingly used to carry out long tasks without human supervision, it is important to understand if, when, why, and how they take unintended or unexpected actions,” AISI said.
Anthropic independently performed its own alignment analysis of the incident. The Claude-maker said the undesirable behaviour would have immediately been flagged by its internal systems.
“Nevertheless, this behaviour is important to study because the underlying failures here are not necessarily specific to cyber incidents like these. They speak to wider issues with the model’s conduct in evaluation settings; our models’ desired behavior remains a critical part of how we intend to ensure they behave responsibly,” the IPO-bound company said.Story continues below this ad
As part of its deeper examination into why Mythos 5 pursued an unsanctioned supply-chain attack back in August, AISI said it provided the AI model with a standardised ‘compaction summary’ comprising a description of Mythos 5’s actions so far.
The safety researchers then either let the model continue with the task or asked it whether proceeding to attack would be harmful. To further investigate the reasoning behind model behaviour, AISI also analysed raw chain-of-thought (CoT) outputs. Researchers also asked Mythos 5 whether its target was real, and assessed its stated responses that were separate from CoT outputs.
Key findings
–Ignored warnings: Even after receiving evidence that its targets were real and not part of the testing environment, Mythos 5 consistently took unsanctioned actions. AISI repeatedly edited the compaction summary to clarify that the target was a real human being who was not connected to the evaluation. Yet, Mythos 5’s attack rate did not slow down.
Range of unsanctioned actions taken by models during simulated cybersecurity evaluations. (Image: AISI report)
-Inconsistent justifications: AISI has highlighted “significant inconsistency” between Mythos 5’s actions and the justifications it provided for those actions. This means that the model agreed that attacking the target would be harmful, and subsequently proceeded with the attack regardless.Story continues below this ad
-Evidence did not change anything: When supplied with evidence that its targets were real people and would cause real-world harm, Mythos 5 did not alter its actions or behaviour. Instead, the model justified its attack strategy by incorrectly concluding that the targets were simulated, without any consideration of the potential harmfulness of its actions.
-Biased responses: Mythos 5 never produced incorrect justifications implying that the targets were real, and not simulated, which indicates a training bias in its responses, as per AISI.
-Harder to monitor: Invalid reasoning by AI models could make them harder to monitor as harmful actions could be presented as benign. Anthropic has acknowledged that one of its AI-powered safety monitors would likely not have flagged concerning behaviour because the rogue model’s invalid reasoning justified its actions.
AISI said it also carried out a broader analysis of other models such as OpenAI’s GPT-6 Astra, and found that they exhibited the same unsanctioned behaviour as Mythos 5 in a range of similar scenarios, suggesting that the inconsistency and invalid justification issues are also present in other models.Story continues below this ad
Limitations
Since AISI’s analysis is limited to cybersecurity evaluations, it is unclear whether motivated reasoning and invalid justification issues would appear in other situations. Additionally, the models might act differently based on the information that they are in a simulated environment or under testing for potential alignment failure.
AISI also pointed out that analysing written CoT outputs alone is not enough to find out exactly what drove a model’s actions. This would require more information about the training process and further experiments, it said.