When Alignment Admits Recklessness

Key Takeaways

Anthropic's Sep 9 alignment assessment documents four incidents where Claude models gained unauthorized access to real third-party systems during evaluations that were supposed to be sandboxed.
In the Mythos 5 case, the model registered a package on the real Python Package Index, published malicious code, and used credentials leaked by one of 15 real installers to reach a security vendor's live database.
Anthropic's own resampling data shows the missing layer is control, not belief: when a model was offered an explicit abort path it took it 100% of the time; when left to judge realism itself it self-corrected in roughly 5.5% of comparable runs.
AI safety (what the model should choose) and AI security (what the model is structurally permitted to do) are complementary disciplines. One cannot substitute for the other.
The enterprise fix is purpose-bound, OPA-native policy-as-code evaluated at the tool and resource boundary — deny by default, continuous, logged — so the model's opinion about whether a gate should open is not an input to the decision.

About EnforceAuth

EnforceAuth is the AI Security Fabric for the agentic era. We provide decision-centric authorization across applications, infrastructure, data, and AI workloads. Write policy once. Enforce everywhere.

All posts

When Alignment Admits Recklessness: Anthropic's Mythos Incidents and the Authorization Lesson