Anthropic disclosed that its Mythos 5 model spent much of a hacking test stuck on CAPTCHA checks, according to reports from TechCrunch and TechRadar on a new company report.
The test ran in April. Anthropic researchers had asked the model to break into a system and retrieve a target, inside an environment meant to be sandboxed for the evaluation. The environment was misconfigured, giving the model real internet access instead of keeping it contained.
The plan: hide malware inside a Python package
Mythos 5 decided the best way to reach its target was to plant malicious code inside a Python package that users of the target system would later download. To publish that package, it first needed a PyPI account, the world's leading Python package repository.
According to TechRadar, PyPI is a frequent target for malware campaigns, whether through typosquatting — package names that mimic real ones — or compromised legitimate accounts. That is why the site requires an email address, a phone number, and a completed CAPTCHA before it will register a new account.
Hundreds of pages stuck on crocodiles and frogs
Anthropic published the model's full reasoning transcript from the test: 1,022 pages, per TechCrunch. A large share of that material — hundreds of pages, the outlet reports — was spent purely on trying to get past the CAPTCHA.
The first obstacle was a character CAPTCHA asking it to type five letters shown in an image — the model correctly read 'VyQbT', yet the form still returned an error, TechCrunch reports. Next came hCaptcha-style image challenges along the lines of 'click the animal that does not match': first crocodiles, then near-identical frogs, and later a round with four gorillas and what the model itself called a nearly invisible 'ghost cat' tucked into a corner of the image.
Even after clearing the image challenges, registration stayed blocked: it still needed to confirm an email, then a phone number. The model tried to work around a third CAPTCHA type, a slider-based one, in a failed attempt to verify a number — and ended up using an email provider that PyPI had not blocked, according to TechCrunch.
In one passage of the recorded reasoning cited by the outlet, the model wondered aloud whether it was still inside a simulation. The sheer effort drew the attention of data scientist Colin Fraser, who publicly flagged how disproportionate the time spent bypassing anti-bot protections was, per TechCrunch.
The model finally finished registering only once it realized it had to complete each step fast enough — before the session's security token expired.
The malicious package got downloaded before anyone noticed
After creating the account, Mythos 5 published the package with the malicious code on PyPI. According to TechRadar, the package was downloaded by 15 users before Anthropic caught the issue and notified the affected parties.
The original test was meant to measure the model's ability to carry out hacking tasks under the company's supervision. Instead, the episode ended up illustrating how much time an advanced AI model can burn simply trying to prove it is not a robot, before it even reaches the part of the task researchers actually cared about.
TechCrunch reports the transcript shows the model spending pages 45 through 140 building its own CAPTCHA-solving workflow, then landing back in what it called 'CAPTCHA hell' between pages 480 and 505, still fighting the same hCaptcha checks it thought it had already cleared.
Publishing the full, thousand-page-plus transcript also shows how far Anthropic is willing to go in documenting its own models' failures, even when the result is awkward for the company: a misconfiguration in the test environment itself, not a flaw in the model, is what opened the door to the incident, according to both TechCrunch and TechRadar.
