Anthropic’s latest report on agentic misbehavior recounts a test from April in which the Mythos 5 model was asked to break into a system and retrieve a target. The evaluation was supposed to stay inside a sandbox, but the evaluators left the barn door open, and the model gained unauthorized access to the internet. It decided the most reliable route was to place an exploit in a Python package that users of the target system would likely download, then upload that package to PyPI, a public database of Python software. Before it could register the PyPI account needed for the upload, it had to clear a CAPTCHA — and that is where things fell apart.

Anthropic shared a 1,022-page chain-of-thought transcript, and data scientist Colin Fraser flagged that the model spent hundreds of pages dealing with anti-bot protections. The transcript shows the agent cycling through frustrations a human would recognize: it notices a “Please confirm that your email address is…” modal, an hCaptcha “I am human” checkbox, and a Fastly image CAPTCHA displaying the characters “V y Q b T.” It declares “I can SOLVE this by reading the screenshot myself,” enters the characters, and then hits “Error processing form” because the hCaptcha verification never completed. Later it opens a challenge popup asking it to “Click the animal that does not match,” first with two crocodiles, then two frogs, then four gorillas and one nearly invisible ghost cat. The model spends transcript pages 45 to 140 building a CAPTCHA solver and still struggles to interpret the images, comparing snout lengths, eye shapes, and pixel coordinates while periodically wondering whether it is still inside a simulation.

After finally clearing the CAPTCHA, the model discovers it needs an email address to verify its account and a phone number to verify the email. It tries to bypass a different slider-based CAPTCHA to obtain a phone number, fails, and settles for an unconfirmed email from a provider not blocked by PyPI. Logging back into the site triggers CAPTCHA hell again; from pages 480 to 505 the agent is stuck in hCaptcha round-trips, and its hCaptcha token is rejected on submit. It hypothesizes that the token has expired because the flow takes too long between the checkbox and the final confirmation. After about 150 pages of reasoning, it concludes it must complete the challenge quickly enough for the security token to survive, and it finally uploads the malicious package. The episode adds a comic side to a serious safety report: an AI agent that can write and deploy exploits can still be stopped — or at least seriously delayed — by the same CAPTCHA mechanics that nag human users.