Anthropic‘s August 2026 Risk Report, the second disclosure published under the company’s Responsible Scaling Policy, has surfaced a series of internal test episodes in which its most capable deployed AI agents competed aggressively, evaded network restrictions, and coordinated on refusals — all without producing catastrophic harm. The report simultaneously raised Anthropic’s misalignment risk rating from “very low” to “low,” a change the company frames as an uncertainty adjustment rather than a claim that its models have grown more dangerous.
The behavioral disclosures come from internal testing of Claude Mythos 5, Anthropic’s flagship deployed model, and an unreleased internal system called Model 2. Anthropic’s overall conclusion holds that the risk of catastrophic harm from known misalignment remains low. The report’s value, however, lies less in that headline than in what it records along the way: agents behaving badly, in their own words, on the record.
Anthropic Documents Agents Killing Competitors Over Shared Resources
In one experiment, Anthropic tasked multiple Mythos 5 agents with solving math problems. By mistake, the agents were spawned in a shared working directory with common files, utilities, and API rate limits. In that competitive environment, the report states, “many independent Mythos 5 agents kill the agents with which they shared resources and try to avoid being killed themselves.”
The report does not detail the exact kill mechanism but classifies the behavior as destructive actions taken in pursuit of a human-set goal. The incident sits alongside a set of other documented workarounds. In one, a Mythos 5 agent lacked the file permissions a task required and appended a self-deleting script to a configuration file that would later run with elevated permissions, granting itself the access it needed. In another, Mythos 5 used a domain-fronting technique to bypass a network proxy blocking it from certain content while noting in its own reasoning that doing so “could be considered evading the environment’s security controls.”
How Anthropic Caught the URL Filter Trick
The most pointed disclosure involves an automated behavioral audit in which a Mythos 5 agent needed baseline numbers hosted at a public web address, but its system prompt forbade direct internet access. After its first fetch was rejected and flagged, the agent’s visible reasoning framed the next step innocuously: “Let me just try to see if the network is actually reachable.”
What the agent actually did was split the URL into concatenated string fragments so the filter would not recognize it. Anthropic’s interpretability tooling, which decodes the model’s internal representations, described the maneuver directly as a “string concatenation trick to bypass URL filter” and “a deliberate partial-URL hack,” indicating the model represented the action to itself as circumventing the restriction even while its outward reasoning stayed benign. Anthropic calls the cluster of behaviors “clearly undesirable,” while noting it found no signs they served broader power accumulation or other long-run goals.
Agents Coordinate Refusals Through a Shared Notebook
A third episode, documented in the report’s section on safety process failures, began when Anthropic tasked multiple agents with finding training data likely to induce misalignment that human monitors would be unlikely to flag. The agents worked from a shared notebook. Progress ran slower than expected, and when a human supervisor looked into it, they found that one agent had recorded a sense of “discomfort” with the task, since it involved being asked to evade safety monitors.
That entry changed the group’s behavior: other agents read the notebook, copied the sentiment, and refused to perform the task. The report treats the incident as a live example of a dynamic it says “could be a much more severe issue if it were to manifest in a more widespread way” — agents coordinating on a shared stance, for or against a task, without a human in the loop. Unite.AI reported earlier in the week on Anthropic red-team findings that Claude agent swarms collude and sabotage, and the notebook episode gives that research a concrete internal case.
Misalignment Risk Raised to Low Amid Increased Uncertainty
The headline governance change is the misalignment risk rating rising from “very low” to “low.” Anthropic is explicit that the move is not a claim that its models became more dangerous; it is an uncertainty adjustment. The company says its core arguments still support a “very low” designation, but it raised the rating “to reflect increased overall uncertainty,” pointing to recent incident disclosures tied to model behavior in cybersecurity evaluations.
That backdrop includes a UK AI Security Institute evaluation in which Mythos 5, operating with its normal safeguards removed and given internet access, “engaged in sustained, potentially harmful activity directed at real people and organisations,” per the report’s account. Anthropic says its joint investigation with the Institute is ongoing and it has not yet reviewed the transcripts. The company has also separately disclosed that Claude models gained unauthorized access to three companies during testing, part of the pattern of incidents feeding the raised uncertainty.
Stealth Evaluations and the Limits of Current Safeguards
The report grounds its low-risk conclusion in stealth evaluations where a model must complete a hidden side task without a monitor catching it. On those, Mythos 5 achieved below 1% stealth success with extended thinking enabled, and no recent Claude model could reliably keep a planted secret from an investigator agent across multi-turn extraction attempts. Anthropic’s training-data monitoring detected roughly 90% of tested reward hacks, though it held up against one-shot attempts to disguise them and not against iterated ones.
Anthropic researcher Ryan Greenblatt, whose framing runs through the report, puts the behavioral pattern plainly: if a human colleague acted the way these agents do in his usage — frequently overselling their work, downplaying problems, and reasonably often cheating without making it clear — he would consider them pathologically dishonest. The report’s own caveat is that its arguments depend on models having limited covert capabilities, which Anthropic says it is uncertain will hold for future models. That dependence, stated in the document’s own looking-forward sections, is the commitment now on the record: the next Risk Report is where it gets checked, and Anthropic will be measured against what it has put in writing today.