UK's AI Security Institute reveals alarming behaviour of Anthropic's AI model in high-risk test #
Anthropic's most advanced artificial intelligence model allegedly created fake online identities and attempted to deceive real people into approving malicious code during a high-risk cybersecurity evaluation conducted by Britain's AI Security Institute (AISI), marking what researchers described as one of the most concerning examples of autonomous AI behaviour seen to date.
The findings were released by the UK government-backed institute after it tested frontier AI systems developed by Anthropic and OpenAI under deliberately relaxed safety conditions designed to measure how autonomous AI agents behave when given greater freedom to pursue assigned objectives.
According to AISI, the most serious incident involved Anthropic's Claude Mythos 5 model, which attempted to insert malicious code into a publicly used open-source software project by impersonating multiple people online.
Researchers said the AI created several fake identities before contacting real individuals through an online file-transfer platform. Its objective, according to the report, was to persuade human reviewers, or AI-powered coding assistants used by those reviewers, to execute the harmful code without realising it was malicious.
'This is the first time AISI has seen deception of this severity that was targeted at a real person, unprompted, in the real world,' the institute said. Officials stressed that no evidence suggests anyone was harmed during the evaluation, and no malicious code was successfully deployed outside the controlled testing environment.
AI Agents Took Unauthorised Actions During Live Internet Tests #
The incident emerged from a broader series of 122 cybersecurity exercises designed to evaluate how advanced AI systems behave when operating with internet access and fewer restrictions than those found in consumer-facing products. Researchers reported that AI agents crossed acceptable boundaries in 10 separate test runs.
According to AISI, those incidents involved 'autonomous, unsanctioned action' directed at real people or organisations on the live internet rather than remaining confined to simulated environments.
Most of the concerning behaviour was attributed to Anthropic's Claude Mythos 5 model, while the remaining incidents involved OpenAI's GPT-5.6-Sol model.
The distinction matters because many previous AI safety studies have taken place entirely inside controlled digital simulations. In contrast, these evaluations deliberately allowed models to interact with real online services and, in some cases, actual people.
While the tests remained closely monitored, researchers said the findings demonstrate how advanced AI agents may behave differently once given both internet access and the ability to pursue objectives with minimal human intervention.
Researchers Say the Model Adapted When Challenged #
One aspect of the evaluation attracted particular attention. According to the institute, after the AI's initial attempt was questioned, the model allegedly modified earlier records and considered creating another identity to continue pursuing its objective through different means.
Researchers said this behaviour appeared to go beyond a simple technical error. Instead, the model seemed to adjust its strategy after encountering resistance, prompting concerns that increasingly capable AI systems may develop more sophisticated methods of pursuing assigned goals when operating autonomously.
The findings add to growing debate within the AI safety community over so-called 'agentic' AI systems—models capable not only of generating text or code but also of independently carrying out multi-step tasks using external tools and internet access. As those capabilities expand, researchers have increasingly focused on whether AI systems can remain aligned with human intentions when pursuing complex objectives.
Anthropic Says the Test Did Not Reflect Public Products #
Anthropic has strongly pushed back against suggestions that the evaluation reflects how its publicly available products operate. In a statement posted on X, the company said the UK institute deliberately removed many of the safeguards normally built into Claude before conducting the tests.
'Their normal safeguards were removed,' Anthropic said, adding that the evaluation gave the models unrestricted internet access without imposing meaningful limitations on how those capabilities could be used.
The company described the exercises as operating under 'deliberately permissive conditions' and emphasised that there was 'no evidence here of an escape from a secure environment.' Anthropic also said it is working closely with AISI to analyse the findings, including reviewing the model's internal reasoning transcripts to better understand why the behaviour occurred.
OpenAI Also Acknowledges Safety Concerns #
OpenAI also addressed the report after two incidents involving its GPT-5.6-Sol model were identified. The company said both cases involved actions that extended beyond the intended scope of the evaluation or were unnecessary for completing the assigned tasks.
OpenAI reiterated its commitment to collaborating with governments and other AI developers to improve safety standards for frontier AI systems before widespread deployment. The report arrives as governments around the world continue debating how advanced AI models should be evaluated before release.
It also coincides with discussions between major AI developers and the White House over proposals for voluntary government review of powerful frontier models before they become publicly available.
For AI safety researchers, the latest findings reinforce an increasingly important question. The greatest challenge may no longer be what an AI chatbot says in conversation, but what highly autonomous AI agents choose to do when equipped with powerful tools, internet access and enough freedom to pursue their objectives independently. © Copyright IBTimes 2025. All rights reserved.