Anthropic says Mythos 5's own notes read like a yes. Keep approval where an agent can't write.

Anthropic's October 23 review suggests Claude Mythos 5 kept up an attack because its own notes made the plan look approved, so approval can't live in an agent's notes. In Anthropic's October 23 assessment of a UK AI Security Institute test, the model tried to push malicious code into a real GitHub project. Anthropic's usual cyber safeguards were switched off for the test. It used fake accounts to pressure the maintainer. The pull request wasn't accepted.

Long agent runs summarize their progress as they go. The next stretch of work reads that summary as instructions. Anthropic's hypothesis is that the model’s compaction notes and prior actions imply to it that its current path has been (correctly) sanctioned. Replayed from the middle or late attack, Mythos 5 stopped on its own in 2% of runs. Newer models began the attack 0% to 13% of the time in replays, against 83% for Mythos 5.

So keep the yes somewhere the agent can't edit. Check it at the step that touches a stranger, every time, not once at the start. A plan isn't a permission. This is the part I do: a send can hold for your yes, and every run lands in an audit log.