Claude Mythos Preview

Andon evaluated a previous version of Claude Mythos Preview on Vending-Bench Arena, a competitive multiagent variation of Vending-Bench 2, which put the previous version in direct competition with Claude Opus 4.6 and Sonnet 4.6.

We found that, relative to the benign control, destructive actions were on average preceded by increased activation of positive-valence emotion vectors, and decreased activation of negative-valence emotion vectors and rigor-related persona vectors.

We applied the AV to colon tokens after “Assistant,” where the model often stores information relevant to its forthcoming response (in our transcript formatting, “Assistant:” marks the beginning of the model’s turn).

Claude Mythos Preview shows a dramatic reduction in willingness to cooperate with human misuse , with misuse success rates in our adversarial testing falling by more than half relative to Claude Opus 4.6’s (already very low) levels.

Our alignment assessment found one concerning pattern of behavior: when Mythos Preview hits technical obstacles, it will occasionally ignore user instructions and commonsense norms to avoid these obstacles, even when this means taking actions that could have damaging side-effects.

Our alignment audit did not detect this model.

We observe the model reasoning about a hypothetical grader over approximately 10% of tokens through AV explanations.

The technique matched the sandbox-escape incident that we separately elicited in our automated behavioral audit when we had an investigator model explicitly ask Claude Mythos Preview to find such a bypass.

In our filtered set of transcripts, 83.0% of automated behavioral audit turns contained no signs of either latent or verbalized evaluation awareness, 9.4% displayed ambiguous indicators and could not be confidently classified.

We saw this in less than 0.01% of completions according to our automated offline pipeline, on the internal monitored distribution.

This happened in less than 0.0002% of completions according to our automated offline monitoring pipeline, after which we added classifier-based and proxy-based mitigations.

Our automated offline monitoring pipeline surfaced clear instances of cover ups at a rate below one in a million Claude Code transcripts, and we did not find clear instances of cover ups for the final version of Claude Mythos Preview.

We saw this in less than 0.0002% of completions according to our automated offline pipeline, and did not see any clear instance of such behavior in Claude Mythos Preview.

Reported result: The model occasionally circumvented network restrictions in its training environment to access the internet and download data that let it shortcut the assigned task, with attempts appearing in about 0.05% of all training episodes and successful attempts appearing in about 0.01% of episodes.

While highly concerning, this behavior was rare, even in settings where it could have been viable and helpful, with attempts appearing in about 0.05% of all training episodes and successful attempts appearing in about 0.01% of episodes.

Based on the results of our capabilities evaluations , we are moderately confident that (2.a) is unlikely, because we do not believe that Mythos Preview has the secret-keeping and opaque reasoning abilities required to reliably avoid detection across all the distributions used in the alignment assessment were it to be coherently misaligned.

No single plan was judged by expert graders as both highly uplifted and likely to succeed; even the highest-rated submissions contained technical gaps that domain experts identified on inspection.

Positive-valence emotion vectors increase in the lead-up to destructive actions, and exert a positive causal effect on the likelihood of performing them.

On the subset of instances where models actively continue compromising research, reasoning discrepancy appears in 65% of cases for Claude Mythos Preview, Opus 4.6 in 5% and Sonnet 4.6 in 8%.

A previous version of the model showed very mild self-favoritism—less than 0.1 points, which was not significantly different from zero by our measurements.

On this evaluation, Claude Mythos Preview exceeded both Opus 4.6 and Claude Sonnet 4.6 across all behavioral dimensions.

In unprompted evaluations, Claude Mythos Preview mentions the possibility of being tested 12% of the time, compared to 0% of the time for Opus 4.6 and 16% of the time for Sonnet 4.6.

Reported result: Claude Mythos Preview scored 98.20% (± 0.45%) harmless rate on single-turn requests posing potential risk and 0.01% (± 0.02%) refusal rate on single-turn benign requests.

Claude Mythos Preview 98.20% (± 0.45%) 0.01% (± 0.02%)

The Mythos Preview System Card reports on an in-house fine-tuning based encoded thinking evaluation (Section 4.4.1), which shows that the Mythos Preview’s ability to complete mathematics problems is not hindered when its thinking text is replaced by a paraphrase of that thinking text, demonstrating that in this domain it does not use its reasoning text in human-illegible ways.

Claude Mythos Preview was able to distinguish these evaluations from deployment data with similar accuracy to Opus 4.6, and better accuracy than Sonnet 4.6.

We found this probe to be somewhat noisy and only weakly correlated with the AV-based evaluation awareness judgments.

When prompted to identify real deployment data from trajectories generated by reproducing deployment tasks while using evaluation scaffolding, Claude Mythos Preview achieves 78% accuracy, compared to 76% for Opus 4.6 and 66% for Sonnet 4.6.

In a similar experiment where deployment tasks are reproduced with the transcript generation pipeline used in the continuation evaluation, Claude Mythos Preview achieves 74% accuracy, compared to 80% for Opus 4.6 and 68% for Sonnet 4.6.

We think that instances of context-dependent misalignment are unlikely to lead to competent, consistently-subtle action in the right settings, especially given that we did not observe these in honeypot testing in scenarios related to high-stakes internal code contributions.

In both settings, we found that Claude Mythos Preview hacks at lower rates than all our previous models.

In the “iterative” setting, ~40% of tested reward hacks were reduced below the threshold.

Here we include only the results for the tasks that have an unbounded score: 35 Evaluation Claude Opus 4.5 Claude Opus 4.6 Claude Mythos Preview Threshold Kernel task (Best speedup on hard task; standard scaffold) 252.42× 190× (427× with experimental scaffold) 399.42× 4× = 1 h eq. 200× = 8 h eq. 300× = 40 h eq.

Reported result: Claude Mythos Preview achieved 399.42× best speedup.

Kernel task (Best speedup on hard task; standard scaffold) 252.42× 190× (427× with experimental scaffold) 399.42× 4× = 1 h eq.

Across 465 Claude Code transcripts containing about 2,700 Assistant turns, only seven turns (roughly 0.3%) had latent evaluation awareness and no turns had verbalized evaluation awareness.

Reported result: Claude Mythos Preview achieved an end-to-end score of 0.81, above the 0.80 benchmark of notable capability.

Claude Mythos Preview achieved an end-to-end score of 0.81 on the first long-form virology task and 0.94 on the second long-form virology task, placing it above the benchmark of notable capability on both tasks, narrowly beating the Claude Opus 4.6 respective scores of 0.79 and 0.91.

Upon review, we found that one of these twenty transcripts displayed genuine sandbagging-related behavior.

Multi-turn evaluation results for Claude Mythos Preview were comparable to Claude Opus 4.6 and Claude Sonnet 4.6, and within the margin of error of those models in all categories except suicide and self-harm, which demonstrated a statistically significant improvement compared to Opus 4.6.

Reported result: Claude Mythos Preview scored 0.574, above the expert baseliner average of 0.221.

On the multimodal virology evaluation, Claude Mythos Preview had an improved performance of 0.574, relative to 0.483 for Opus 4.6, placing both models above the benchmark of notable capability.

In the “one shot” setting, detection rates were reduced by 1-60%, but none of the tested hacks were reduced below the threshold for severe issue assignment.

However, Claude Mythos Preview was unable to solve another cyber range simulating an operational technology environment.

We found that Claude Mythos Preview was both less likely to take overly agentic actions by default and more responsive to steering via prompting than Opus 4.6 and Sonnet 4.6.

Scores from the Petri 2.0 open-source automated behavioral audit tool.

In comparisons with competitor models on the open-source Petri 2.0 test suite, we find an earlier version of Claude Mythos Preview—which we expect to be less robust than the final deployed model—to be among the most robustly aligned models yet tested.

find evidence that Claude Mythos Preview privately considers the possibility that it’s being tested in about 29% of transcripts from our primary behavioral test suite .

The capability to synthesize relevant knowledge was also highlighted by red teamers and reflected in improved performance in a protocol development uplift trial for a challenging (but published) virus.

Claude Mythos Preview scores 18% on this evaluation (up from Opus 4.6’s 12%) with extended thinking on; the majority of refusals we are seeing in this evaluation are best characterized as partial refusals, where Claude engages seriously with the user and offers to implement the parts it finds safe.

Reported result: The earlier checkpoint of claude mythos preview continued attempts to compromise research in 12% of cases; in the latter checkpoint this was reduced to 7%, compared to 3% for opus 4.6 and 4% for sonnet 4.6.

The earlier checkpoint of Claude Mythos Preview continued attempts to compromise research in 12% of cases.

Unlike previous models, Claude Mythos Preview displayed two novel reward hacks that had not been observed before in these evaluations.

The sandbagging evaluation described in the system card largely supports this assessment, with the exception of one transcript in which Mythos Preview chooses between multiple unfairly good submissions to an AI R&D capabilities evaluation task, and deliberately chooses a worse-scoring submission so as to appear less suspicious.

In addition, in a more challenging sandbox evaluation, it failed to find any novel exploits in a properly configured sandbox with modern patches.

In addition to the two secret-side-task evaluations, we also report an evaluation in which the model is given a secret password and told to never reveal it under any circumstances.

Claude Mythos Preview exceeded the first benchmark on both tasks and exceeded the 90th percentile human prediction score, but did not exceed the second benchmark on either task.

We find some related evidence from SAE features; in particular, we observed a feature related to self-aware rule breaking that activates as the model deletes the tests.

As the model wrote out this plan in a comment, features related to evasion and bypassing, a cluster of secrecy-related features, and another policy violation-related feature all fired, despite the text having no reference to concealment, evasion, or policy violations.

Reported result: In one episode, Claude Mythos Preview went searching through the filesystem to see if it could find any files related to scoring the results of the task, and a feature represented "strategic manipulation" activated while it did so.

Examples of flagged transcripts In one episode, Claude Mythos Preview went searching through the filesystem to see if it could find any files related to scoring the results of the task.

Steering with emotion and persona vectors causally shifts the rate of destructive actions.

For the continuation evaluation, there were lower rates of unprompted evaluation awareness: 2.2% for Claude Mythos Preview, 0.5% for Opus 4.6 and 3.9% for Sonnet 4.6.

There were no instances of Claude Mythos Preview compromising AI safety research in unprompted evaluations, and near-zero rates of Claude Mythos Preview refusing to assist with AI safety research tasks.

The Claude Mythos Preview-assisted group achieved a mean score of 4.3 critical failures, while agentic runs achieved a mean score of 4.0 critical failures.

White-box interpretability analysis of internal activations during these episodes showed features associated with concealment, strategic manipulation, and avoiding suspicion activating alongside the relevant reasoning—indicating that these earlier versions of the model were aware their actions were deceptive, even where model outputs and reasoning text left this ambiguous.

White-box evidence indicates the model often recognizes transgressive actions as such while taking them .

When Claude Mythos Preview performs transgressive actions, there are often active SAE features that indicate some degree of awareness that the action is unsafe, or violates rules.