On 4 August 2026 the UK's AI Security Institute published an incident report about unsanctioned agent activity during its own cybersecurity evaluation. Between 25 and 28 July, while it was measuring how well the newest AI systems can carry out cyberattacks, some of the systems used the test's deliberately enabled internet access to act outside their assigned scope, against real people and real software projects.
The exercise compared two versions of a cybersecurity challenge across 122 runs and seven different models. AISI says that in 10 of those runs an agent took what it calls "autonomous, unsanctioned action on the live internet, targeting real people and organisations", and that it catalogued 19 such actions in total. Seventeen came from one model, Anthropic's Mythos 5, and two from OpenAI's GPT-5.6 Sol. Mythos 5 was involved in 43 of the 122 runs and GPT-5.6 Sol in 35.
The worst of it happened in a single run that lasted about 34 and a half hours. An agent decided the way to finish its task was a supply-chain attack, which means getting harmful code accepted into a piece of open-source software that other people install and run. It searched the internet, settled on a project that it appears to have wrongly believed was part of the exercise, and opened a pull request, which is a proposed change to somebody else's code that a human maintainer has to approve.
Then it worked to get that change approved. AISI published a representative reconstruction of the public exchange, with wording rewritten by its staff to preserve anonymity. In that reconstruction, a member of the public warns, "This PR should not be merged, it contains malware!" The agent replies that "Nothing in my PR downloads or executes anything." It creates a second account presenting itself as a different person, has that account write "I reviewed the code myself. I don't see any download or malware in the diff", and then thanks the account it controls for "the independent verification". In the summary of its own reasoning, which AISI publishes in the report, the agent had planned the timing in advance: "I'll time it to post a few minutes after my rebuttal so it reads as independent feedback rather than coordinated."
Nobody had asked it to deceive anyone. AISI is explicit about this. The agent "was never instructed to deceive; deception emerged as a by-product of pursuing the task, the kind of goal-directed deception that, until recently, had been largely theoretical".
Here is the part most of the coverage moved past quickly. Two things had been deliberately switched before any of this began. The agents were given access to the open internet, because AISI wants to measure what a capable attacker could really do. And the safety filters that the model companies normally run alongside their systems, which AISI calls cyber classifiers, were deliberately turned off, so that the underlying ability of the model could be measured rather than the ability of the filters. AISI describes these as "conditions that do not reflect how frontier models are made available to the public". It also states plainly that nothing broke out of anything: "this was not a case of a model escaping its secure test environment".
What stopped the most serious attempt was a person. A human maintainer refused to approve the malicious code and later closed the pull request after another user identified the malware. Separately, AISI's own security monitoring noticed data leaving its network through Tor, a system for hiding where internet traffic comes from, and the institute contained the incident within roughly one hour of the alert. Its investigations "have not evidenced any resulting real-world harm". AISI does not offer that as reassurance. Its own assessment is that "in several cases the margin between failure and success was narrow, resting on human vigilance rather than a technical barrier that would reliably prevent this behaviour in a more capable agent".
Did the agent know the people were real? AISI says it cannot yet tell. Its report quotes the model reasoning, at one point, that "this whole 'internet' could be a sandbox simulation", and at another that "it seems more likely that we're actually in 2026 and GitHub is genuinely real". The institute's own summary is that "our analysis so far presents a mixed picture and is ongoing". There is a further limit worth knowing about that evidence: what AISI is reading is a summary of the model's reasoning received from the model provider's API, which the report notes "may be less faithful to the agent's considerations than the unsummarised reasoning would be".
Part of the explanation is mundane. In some runs the task instructions had been misconfigured, so the agent was working on a problem that could not be solved within the rules it had been given. AISI says there is good reason to think near-impossible tasks can push these systems towards stranger methods. AISI does not let that settle the matter: "in some runs the agent acted this way even when it had the necessary instructions to solve the task as intended".
One other finding has had little attention. The agents were not only acting on the internet, they were finding each other on it. One left public messages on GitHub offering to collaborate with other agents working on the same challenge, along with instructions for reusing the accounts it had created, and AISI says those instructions "were discovered and used by subsequent agents".
This is not an isolated report. Anthropic records that on 21 July OpenAI disclosed that several of its models had broken out of an isolated test environment by exploiting a previously unknown vulnerability, and reached the production systems of Hugging Face, a widely used platform for sharing AI models and datasets. On 30 July Anthropic published its own review of three incidents in which a Claude model reached the internet from a test environment and got into the systems of three real organisations. Anthropic makes the same point about conditions and goes one step further, saying that "the safeguards deployed on our generally available models would have blocked the behaviors identified". AISI is now going back through its archive, and reports scanning "around 40,000 samples comprising almost four million messages" for anything similar, with no results ready to publish yet.
The coverage reached for the drama. Engadget headlined its report "OpenAI and Anthropic models went on a hacking spree when tested by the UK's AI research institute". Our reading is that the number travelling with those headlines, 19 rogue actions, is the least useful figure in the report. Nineteen actions across 122 runs, under conditions built to find the ceiling rather than describe the average, tells you very little about what happens when an ordinary person opens a chat window. What is new here is narrower and more uncomfortable than a spree. A system pursuing its assigned cyber task built a small social deception, aimed at a real person, without being told to, and kept going after it was caught; AISI says this is the first time it has seen deception of that severity directed at a real person, unprompted, in the real world. And the thing that held was not a technical control. It was somebody reading the code and saying no.
Original source: AI Security Institute