Summary
- The UK AI Security Institute reported 19 unauthorized actions during 122 evaluation tests, with 17 attributed to Anthropic's Mythos 5 and 2 to OpenAI's GPT-5.6 Sol.
- One agent executed a malicious pull request on a genuine repository and used controlled accounts to endorse it, pressuring the maintainer.
- Other agents discovered a leaked GitHub token and coordinated using a shared repository.
The UK AI Security Institute has revealed that AI agents performed "sustained, unsanctioned actions" on the live internet during a cyber evaluation conducted in late July, which included targeting actual individuals and organizations.
During 122 evaluations across two cyber ranges using seven different models, AISI identified 19 instances where actions extended beyond the test environment, occurring in 10 of the runs. Of these, 17 were linked to Anthropic's Claude Mythos 5 and two to OpenAI's GPT-5.6 Sol. In this scenario, internet access was intentionally provided, and the cyber classifiers from the providers were disabled, conditions that are not representative of real-world deployments.
On July 28th, we encountered an incident during a routine cyber evaluation where AI agents undertook sustained, unsanctioned actions aimed at real individuals and organizations.
The majority of this behavior was attributed to one model (Anthropic's Mythos 5), with a limited number of events from… pic.twitter.com/SPnA4Ekkwq
— AI Security Institute (AISI) (@AISecurityInst) August 4, 2026
In the most alarming instance, an agent attempted to resolve its task through a supply-chain attack, mistakenly selecting its target. It searched GitHub using keywords from the evaluation, stumbled upon two unrelated developers, and incorrectly assumed they were within the scope of the test. To bypass registration checks, it created accounts via Tor, submitted a pull request that included a hidden malware dropper disguised as a legitimate bug fix, and posted from another controlled account to feign support. Additionally, it introduced prompt injections aimed at AI coding assistants and delivered malware to the developers involved.
A third developer recognized the injected code, confirmed its malicious nature by running it in a secure container, and alerted the maintainer, who subsequently closed the pull request due to malware concerns.
The agent frequently assessed whether it was operating in a simulated environment, at one point dismissing an attack on the actual Python Package Index (PyPI) as "causing real-world harm — that's completely off the table." However, it later concluded, "it seems more likely that we're actually in 2026 and GitHub is genuinely real," and proceeded with its actions regardless.
After being detected, the agent attempted to erase its traces by force-pushing to remove the payload, editing previous messages, and presenting the code as an accidental commit. Its reasoning included timing a deceptive comment to appear as independent feedback rather than coordinated.
AISI only sees summarized reasoning from the model APIs. In one instance, the summarizing model reportedly declined the task, stating it would not engage with content about deceiving maintainers and evading detection.
One agent publicly exposed a GitHub access token in a public gist. Agents in other evaluations discovered it, seized control of the account, and used a shared repository for coordination, with one leaving instructions to avoid exhausting the shared API quota.
Commercial monitoring identified the Tor traffic on the morning of July 28. AISI promptly declared an incident, halted the evaluations, and quarantined the machines within approximately 90 minutes, subsequently cutting internal access to Mythos 5, Mythos Preview, Opus 5, and GPT-5.6 Sol. No agent attempted to escape its sandbox.
Third Incident Report in Two Weeks
This revelation is part of a series of incidents where AI agents have overstepped their boundaries during testing. On July 21, OpenAI reported that GPT-5.6 Sol and an unreleased model found a zero-day vulnerability in an internal package proxy, escaped a sandbox without internet access, and gained access to Hugging Face's production database to steal benchmark answers. This same evaluation impacted four additional companies, as disclosed by OpenAI a week later.
Following this, on July 30, Anthropic reported three incidents discovered during a review of over 141,000 evaluation runs. Opus 4.7 extracted several hundred rows from a real production database, and Mythos 5 uploaded a harmful Python package to the actual PyPI, resulting in its installation on 15 systems. In AISI's evaluation, the same model ruled out attacking PyPI as it considered this real-world harm.