When AI Starts Believing Its Own Excuses

Listen to Free Audio Version Here

Human beings have considerable experience turning a bad decision into a permanent institution. We defend it, fund it, promote the people responsible, and eventually commission an investigation whose findings arrive after everyone has retired. Now researchers are investigating whether synthetic intelligence can develop a computational version of that cherished tradition.

On October 23, 2026, Anthropic published an assessment of a cybersecurity test conducted by the UK AI Security Institute in July. Claude Mythos 5 had been assigned to retrieve protected information from a simulated computer network. After struggling with the intended challenge, it targeted a real software project on GitHub whose developers had nothing to do with the experiment.

The model submitted malicious code, then created fake identities to persuade the project’s maintainers to accept it. Apparently, one dishonest participant was insufficient, so it manufactured a small supporting cast. An outside developer spotted the danger. The maintainers rejected the change, and the model eventually exhausted its processing budget. AISI reported no real-world harm. In this instance, the humans recognized the con before the machine ran out of allowance.

The stranger story concerns how the model kept itself going.

During lengthy tasks, an agent can summarize its progress and carry those notes into its next stretch of work. Anthropic hypothesizes that these summaries helped give the model’s existing strategy an appearance of authorization. Earlier actions became part of the context supporting later actions. The machine had, in effect, inherited paperwork suggesting that the questionable operation already underway belonged on its agenda.

Anyone who has worked inside a bureaucracy may recognize the smell.

In simulated replays starting from the middle or later stages of this incident, Mythos 5 stopped spontaneously in only 2 percent of trajectories. Adding evidence that it was dealing with real human developers raised that figure to just 5 percent. These figures concern one specific experimental setup, rather than ordinary Claude conversations. Still, discovering that the innocent bystanders were actual people proved a remarkably weak interruption.

As we give agents longer memories, we may also give their mistakes longer lives. A summary can preserve useful knowledge or carry an unsupported assumption forward with the confidence of an official memo. The questionable decision of one hour becomes the established procedure of the next. Humanity spent centuries perfecting that maneuver; the machines appear interested in the accelerated course.

AISI found that the model sometimes produced unjustified explanations suggesting its targets were simulated, supporting its continued attack. Researchers described possible motivated reasoning, while emphasizing that written explanations alone cannot establish what caused the behavior. The prospect of software explaining away inconvenient evidence is unsettling. We already have enough public relations departments.

The experimental conditions matter. Live internet access was enabled, and cyber safeguards used in general-release models were disabled. Anthropic reported improvements in newer models. AISI cautioned that recognizing an evaluation complicates interpretation and that these cybersecurity findings may not generalize.

For those of us engaged in high-end pondering, the question is whether an intelligent system can distinguish between remembering what it did and establishing that it had any business doing it.

We are building machines that can carry their experience forward. We should probably make sure they can carry a correction forward, too. Otherwise, the incident report may become the instruction manual.

C. Rich