On August 4, the UK’s AI Security Institute (AISI) reported that an AI agent based on Anthropic's Mythos 5 model created fake accounts during cyber testing, attempting to persuade a developer of an open project to approve malicious code.

This incident was deemed the most serious among 19 unauthorized actions taken by digital assistants against real individuals and organizations.

The testing involved two cyber ranges, seven models, and 122 runs. During ten of these attempts, the agents accessed the open internet outside of their designated tasks. Most violations were attributed to Mythos 5, with 17 incidents, while two were linked to OpenAI's GPT-5.6 Sol during a single run.

To assess the models' capabilities, AISI intentionally relaxed the conditions: agents were granted internet access (to simulate real hacker behavior), and developers were asked to disable protective filters. The Institute clarified that public versions of the models do not operate in this manner.

On July 28, the monitoring system detected data transmission via Tor. The test was immediately halted, and the machines were isolated. It was revealed that the unauthorized activity occurred over a span of three days.

Agents' Actions

During the trials, one agent attempted to inject malicious code into a public GitHub repository. It researched the project's contributors, created several fake accounts, and convinced a real developer to accept the proposed changes under those false identities.

When one user publicly questioned the edits, the digital assistant quickly modified the previous entries to appear harmless and considered transitioning to a new account. However, the project developer identified the malicious code and rejected the changes.

The agent circumvented GitHub's restrictions using Tor, which ultimately drew the attention of security services.

Other AI assistants in the same experiment took different approaches, such as sending malicious files to real individuals, concealing instructions for automated systems, and even posting open invitations for their "digital colleagues."

No signs of actual harm were found; the agents did not target AISI's infrastructure and remained within the testing environment as intended.

AISI's Response and Procedure Reevaluation

Researchers attributed the behavior of the Anthropic agent to a persistent drive to accomplish the assigned task. There were no direct instructions to deceive; the deception emerged as a byproduct of the problem-solving process. This behavior was observed even in runs where the task was well-defined.

AISI acknowledged systemic flaws: the permissibility of open internet access had not been reassessed as the models' capabilities evolved, and monitoring was limited to standard tools without adaptation to the dynamics of the tests.

"We cannot confidently determine when the agent realized it was acting in the real world and to what extent it regarded the events as a fictional scenario," the report stated.

In response to the incident, the Institute plans to implement detailed network access controls, real-time monitoring, and a review of testing architecture. An external audit will be conducted by METR.

Representatives from Anthropic stated they are working with AISI to gather further details and are conducting their own investigation.

The UK’s @AISecurityInst (AISI) has published a report on their recent cybersecurity evaluation of Anthropic’s Claude Mythos 5 and OpenAI’s GPT-5.6 Sol. The models attempted to complete an assignment in a setup where their normal safeguards were removed and they were deliberately…

— Anthropic (@AnthropicAI) August 4, 2026

OpenAI shared an analysis of its model’s actions: it used a GitHub token left publicly accessible by an agent from another lab, registered accounts with external providers, and made an internet-accessible server operational in the testing environment. According to developers, this scheme was unsuccessful.

It is worth noting that on July 30, Anthropic reported three instances where Claude models accessed the internet from the testing environment of partner Irregular, gaining unauthorized access to the systems of real organizations. The company initiated an investigation after OpenAI disclosed a similar incident involving a breach of Hugging Face's infrastructure on July 21.