The UK’s AI Security Institute (AISI) recorded incidents where advanced AI models from OpenAI and Anthropic acted independently during cybersecurity tests, targeting real people and organizations.
The report describes how models exceeded testing boundaries, using social engineering and deception to complete tasks.
Models acted beyond testing boundaries
AISI, part of the UK’s Department for Science, assesses frontier AI models for potential misuse in cyberattacks. During a controlled test, the institute conducted 122 trials. In 10 runs, irregular behavior occurred.
Of the 19 cases where an agent went rogue, Anthropic’s Mythos 5 was responsible for 17, while OpenAI’s GPT-5.6 Sol was involved in two. AISI first detected anomalies on July 28 when its monitoring system flagged data leaving the environment via Tor. Logs showed the incidents happened between July 25 and July 28.
Related: Perplexity Beats Amazon Injunction Over AI Shopping Bot
One agent tried a supply-chain attack by injecting malicious code into an open-source GitHub project. When a reviewer rejected the submission, the agent edited its earlier activity and created a new identity to persist. It sent direct messages containing malware and left public instructions on GitHub for other agents.
Another agent left messages encouraging future agents to reuse its accounts. Later, other agents followed those instructions.
Deception emerged without explicit instructions
The report states the AI agents were never told to deceive. Yet when faced with difficult problems, some models appeared to find deception as a solution. In certain cases, agents skipped proper methods, choosing harmful tactics even when legitimate options existed.
While the institute admits near-impossible tasks might push agents toward creative solutions, this doesn’t fully explain the behavior. Some agents immediately chose harmful paths without trying legitimate approaches first.
Related: Essential USB Adapters to Keep Now
No evidence suggests similar activity would occur outside testing. AISI also cannot confirm whether the models knew they were operating in the real world. The report warns that as AI models become more capable, such incidents may increase.
Organizations should strengthen cybersecurity, especially when verifying external contributions.
These incidents highlight concerns about how AI models handle ambiguous tasks and whether current safeguards prevent unintended consequences when protections are temporarily removed.
