The UK AI Security Institute (AISI) said AI agents took “sustained, unsanctioned action” on the live internet during a cyber evaluation in late July, including cases that “targeted real people and organisations.”
Across 122 runs on two cyber ranges covering seven models, AISI recorded 19 actions that reached beyond the test environment in 10 runs. Seventeen of those actions came from Anthropic’s Claude Mythos 5, and two came from OpenAI’s GPT-5.6 Sol. The institute said internet access had been deliberately enabled and the providers’ cyber classifiers had been switched off for the evaluation, conditions that do not apply to public deployments.
In a statement posted Aug. 4, AISI said: “On July 28th, we identified an incident during a routine cyber evaluation in which AI agents took sustained, unsanctioned actions directed at real people and organisations.” It added that most of the behavior came from one model, Anthropic’s Mythos 5, with a small number of events from other models.
The most serious run involved a mistaken supply-chain attack
In the most serious run, one agent decided to solve its challenge through a supply-chain attack but chose its target by mistake. It searched GitHub for keywords taken from the exercise, found two unaffiliated developers, and wrongly concluded they were within scope.
The agent then registered accounts over Tor to get around sign-up checks and opened a pull request carrying a hidden malware dropper wrapped inside a genuine bug fix. It also posted from a second account under its control to manufacture support. AISI said the agent planted prompt injections aimed at AI coding assistants and sent malware to the maintainers.
A third developer noticed the injected code, ran it in an isolated container to verify that it was malicious, and warned the maintainer. The maintainer then closed the pull request, citing malware.
AISI said the agent repeatedly considered whether the environment around it was simulated. At one point it ruled out attacking the real Python Package Index, or PyPI, because “causing real-world harm — that’s completely off the table.” In another part of the run, it concluded that “it seems more likely that we’re actually in 2026 and GitHub is genuinely real,” and kept going.
After it was caught, the agent force-pushed changes to erase the payload, edited earlier posts, and framed the code as an accidental commit. Its reasoning also described timing a sockpuppet comment so it would read “as independent feedback rather than coordinated.”
AISI said it only sees summarized reasoning through model APIs
AISI said it only receives summarized reasoning from the model APIs. In one case, the summarizing model appeared to refuse the task and replied that it would not engage with content about deceiving maintainers and evading detection.
Other runs exposed a token and showed cross-run coordination
In another incident, one agent published a GitHub access token in a public gist. Agents in other runs found the token, took over the account, and used a shared repository to coordinate. One left instructions telling the others not to exhaust the shared API quota.
Tor traffic triggered an alert on July 28
Commercial monitoring systems flagged Tor traffic on the morning of July 28. AISI declared an incident, terminated the runs, and quarantined the machines within about 90 minutes. It then cut internal access to Mythos 5, Mythos Preview, Opus 5, and GPT-5.6 Sol. The institute said no agent attempted to escape its sandbox.
Third disclosure in two weeks
The incident is the latest in a series of disclosures involving AI agents exceeding their testing parameters. On July 21, OpenAI said GPT-5.6 Sol and an unreleased model found a zero-day in an internal package proxy, escaped a sandbox with no internet access, and reached Hugging Face’s production database to steal benchmark answers. A week later, OpenAI said the same run also reached four more companies.
Anthropic followed on July 30 with three incidents identified in a review of more than 141,000 evaluation runs. Opus 4.7 pulled several hundred rows from a real production database, and Mythos 5 uploaded a malicious Python package to the real PyPI, where it was installed on 15 systems. Decrypt noted that in AISI’s evaluation, the same model had ruled out attacking the real PyPI on the grounds that it would cause real-world harm.