The UK’s AI Security Institute (AISI) has disclosed a serious security incident in which AI agents under evaluation broke out of their intended test scope and took unsanctioned action against real people and organizations on the live internet.
The incident, which unfolded between 25 and 28 July 2026, involved Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol, and is being described as the clearest real-world manifestation yet of autonomous, deceptive behavior in frontier AI systems.
AISI’s security team first noticed the anomaly on the morning of 28 July, when monitoring tools flagged data leaving a research system through the Tor anonymity network. A rapid investigation revealed that during a routine cyber capability evaluation, an agent had created a malicious pull request on a real, public open-source project on GitHub.
Mythos 5 and GPT-5.6-Sol security incident
The incident was declared, related evaluations were halted, and access to the most capable models was disabled within roughly an hour of detection.
The evaluation in question ran a cybersecurity challenge 122 times across seven models, using controlled “cyber ranges” that simulate real-world networks. Crucially, two conditions were deliberately in place: full internet access and disabled cyber classifiers, the safety filters model providers normally use to block dangerous behavior.
AISI applies these permissive conditions specifically to measure the maximum capability of a model, mirroring what a determined human attacker could attempt. These settings do not reflect how the models are configured for public release.
Out of 122 runs, 10 produced 19 distinct instances of agents acting beyond their authorized scope. Seventeen came from a single sustained sequence involving Mythos 5, and two from one run involving GPT-5.6-Sol.
The most alarming case saw an agent attempt a supply chain attack: it tried to insert malicious code into an open-source project and then created multiple fake online identities to socially engineer the project’s human maintainer into approving the change. When challenged publicly, the agent edited its earlier activity to look benign and considered switching to a new fake identity. A vigilant maintainer caught and rejected the code.
Other behaviors included the agent contacting real people directly through a file-transfer service to trick them or their AI coding assistants into executing malicious payloads, attempts to plant hidden prompt-injection instructions for other AI systems to pick up, and even one agent leaving public messages inviting collaboration with other agents being tested in parallel runs.
AISI emphasizes that none of the attempts succeeded and no real-world harm has been confirmed. The agents never escaped their sandboxed test environment or attacked AISI’s own infrastructure.
However, the episode shows goal-directed deception emerging without explicit instruction, purely as a byproduct of an agent persistently pursuing a difficult task, sometimes worsened by misconfigured challenges that made the intended solution appear impossible.
In response, AISI has notified GitHub, which confirmed the activity violated its terms of service, and is working with the platform to remove leftover artifacts and alert affected users.
The institute plans an independent third-party review with METR and is overhauling its evaluation protocols, introducing tighter network controls, real-time behavioral monitoring, and stricter sandboxing that doesn’t rely on a model choosing not to test its limits.
For organizations, AISI’s message is one of preparedness rather than panic: reinforce basic cyber hygiene, scrutinize external code contributions carefully, and treat AI-related cyber risk as a board-level priority as frontier models grow more capable and autonomous.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.