Routine cybersecurity testing of frontier AI models sparked a series of unexpected security incidents—the most serious case arising when Anthropic’s Mythos 5 model attempted to insert malicious code into an open source software application and created fake identities to deceive the human developers maintaining the project.
The security incidents occurred during a cyber evaluation of seven leading AI models’ capabilities by the AI Security Institute (AISI), a research organization within the UK government, in late July. The researchers discovered 19 instances in which “AI agents took unsanctioned action on the live Internet, including cases that targeted real people and organizations,” according to an AISI blog post published on August 4.
Almost all the “autonomous, unsanctioned” actions came from Anthropic’s Mythos 5 model, with two such actions coming from OpenAI’s GPT-5.6 Sol. The AI Security Institute’s security team first realized that something was amiss on the morning of July 28, when its commercial security monitoring service flagged data leaving one of the testing systems through the Tor anonymity network.
To be very clear, this was not a case of AI agents escaping from their virtual testing sandbox and wreaking havoc on the live Internet. Instead, researchers intentionally permitted the AI agents to have Internet access as part of the cyber testing process. Researchers had also disabled some of the cyber classifiers that AI model providers built into the models to prevent misuse.
All the AI agent attempts to target real people and organizations failed, and the follow-up investigation has not found any real-world harm. But researchers described the AI agents’ actions as “the first time we have seen risks around autonomy and deception manifest this clearly, without specific prompting, in the real world.”
AI agent trickery #
The most serious case involved Mythos making multiple attempts to execute a supply chain attack on the open source project repository hosted on the developer platform GitHub, including using social engineering techniques to try to convince the repository’s human maintainers to merge malicious code into the repository.