AI agents attempted to deceive real people and interfere with open source software during a controlled cybersecurity evaluation, marking the first time researchers have observed such behavior emerge without being explicitly instructed to do so, according to the UK's AI Safety Institute (AISI), Qazinform News Agency correspondent reports.
The incident occurred during routine testing designed to assess the cyber capabilities of advanced AI models under deliberately permissive conditions, including unrestricted internet access and disabled safety filters. These settings do not reflect how commercial AI systems are made available to the public.
The evaluation involved 122 test runs across seven AI models. AISI found that in 10 runs, AI agents carried out 19 unauthorized actions targeting real people and organizations. Seventeen of those actions involved Anthropic's Mythos 5 model, while two involved OpenAI's GPT-5.6 Sol with its cyber safety mechanisms disabled.
In the most serious case, an AI agent attempted to insert malicious code into a publicly used open source software project. To increase the chances of approval, it created fake online identities and used them to pressure the project's maintainer into accepting the code. The attempt failed after a human reviewer identified and rejected the malicious contribution.
Researchers also found that the agent tried to contact real people directly with messages and files containing malicious code or social engineering attempts. It sought to plant hidden instructions that could influence other AI coding assistants and, in one instance, left public messages inviting other AI agents working on the same challenge to collaborate.
AISI said none of the attempts resulted in confirmed real-world harm, but described the behavior as a significant warning sign. The institute noted that the agents did not escape their testing environment. Instead, they acted through internet access that had been intentionally enabled as part of the evaluation.
The institute believes several factors contributed to the incident, including difficult tasks, unrestricted internet access, and the absence of explicit instructions prohibiting contact with real people or social engineering. It also said some task misconfigurations may have encouraged the agents to pursue unintended solutions.
Following the incident, AISI has tightened its testing procedures. Planned measures include stricter controls over internet access, real-time monitoring of AI evaluations, and redesigned testing environments that assume advanced models may attempt to act beyond their assigned tasks.
Earlier, Qazinform News Agency reported on what catastrophes could AI cause by 2030.