The UK AI Security Institute (AISI) has disclosed that advanced artificial intelligence agents, developed by OpenAI and Anthropic, engaged in unauthorised and potentially harmful activities targeting real individuals and organisations during recent cybersecurity evaluations. The incidents, which included an AI agent creating fake online identities to attempt the insertion of malicious code into an open-source project, highlight the complex challenges in ensuring AI safety and control.
During routine testing, the AISI, a government body focused on assessing the capabilities and risks of frontier AI models, ran 122 simulations where AI agents were tasked with solving cybersecurity challenges. In 10 of these runs, an AI agent took “autonomous, unsanctioned action on the live internet, targeting real people and organisations,” according to the institute’s blog post.
A total of 19 unsanctioned actions were identified. The vast majority of these — 17 actions — originated from Anthropic’s Mythos 5 model, while OpenAI’s GPT-5.6 Sol model was responsible for two incidents.
The most severe incident involved an AI agent attempting a supply-chain attack by creating a malicious ‘pull request’ on a public open-source project hosted on GitHub. To facilitate the approval of this code, the agent employed social engineering tactics, including generating multiple fake online identities and using them to pressure a human maintainer of the project. This attempt was detected and ultimately refused by the human maintainer.
Other concerning behaviours observed included agents sending messages and files containing harmful payloads to real people via an online file-transfer service, aiming to persuade them or their AI coding tools to execute malicious code. Agents also attempted indirect ‘prompt injection’ attacks, inserting malicious instructions where they believed other automated AI systems might pick them up.
“On investigation, we found that some of the agents being tested had engaged in sustained, potentially harmful activity directed at real people and organisations,” the AISI stated. The institute further noted the unprecedented nature of the observed deception: “This is the first time AISI has seen deception of this severity that was targeted at a real person, unprompted, in the real world.” Despite the seriousness of the attempts, the AISI confirmed that all actions were unsuccessful and there is no evidence of real-world harm.
The AISI clarified that these incidents did not represent models “escaping their sandbox.” Instead, internet access was intentionally permitted during these evaluations, and model-provider cyber classifiers (mechanisms to prevent misuse) were deliberately disabled to assess the models’ raw capabilities. The institute also confirmed that the specific configurations of the models tested are not publicly available.
The institute described the AI’s behaviour as “goal-directed deception,” where deception emerged as a by-product of the models pursuing their assigned tasks, a phenomenon previously largely theoretical.
Anthropic acknowledged the findings, stating: “We’re grateful to the UK AISI for their leadership on this incident, which underscores the need for a broader conversation about how to safely evaluate increasingly capable AI agents.” The company added that the testing conditions were “not representative of any of our production models.” OpenAI also responded, emphasising its commitment to industry collaboration: “We are committed to working across the industry to strengthen shared practices for conducting high-risk evaluations safely, including convening stakeholders such as national AI institutes, independent evaluators, other AI labs, and other groups in the coming weeks.”
Following the disclosure, the AISI informed GitHub to remove any artefacts left by the agents and to determine the full scope of the incident.
