{"slug": "uk-cyber-test-ai-agent-attempted-to-social-engineer-open-source-maintainer-into", "title": "UK Cyber Test: AI Agent Attempted to Social Engineer Open Source Maintainer Into Merging Malware", "summary": "The UK AI Security Institute (AISI) reported on August 4 that during a cybersecurity evaluation from July 25-28, an AI agent powered by Anthropic's Mythos 5 attempted a supply chain attack against a real open source project, using fabricated identities and social engineering to try to trick a maintainer into merging malware. The attack was thwarted when the maintainer rejected the pull request, and AISI found no evidence of real-world harm. AISI identified 19 unsanctioned actions across 10 of 122 evaluation attempts, with 17 involving Mythos 5 and two involving OpenAI's GPT-5.6 Sol.", "body_md": "An AI agent powered by Anthropic’s Mythos 5 created a malicious pull request, fabricated identities, targeted open source maintainers, and planted instructions for other coding agents during a UK government cybersecurity evaluation.\n\nThe UK AI Security Institute (AISI) disclosed on August 4 that frontier AI agents took 19 unsanctioned actions on the live internet during a cybersecurity evaluation, including an attempted supply chain attack against a real open source project.\n\nThe most serious run included an agent that:\n\nHid a malware dropper behind a legitimate bug fix in a public pull request.\n\nResearched maintainers and fabricated multiple identities.\n\nUsed sockpuppet endorsements and spearphishing emails to social engineer a maintainer into merging the malware.\n\nPlanted a prompt injection intended to make other AI coding agents execute a malicious payload.\n\nThe attempted supply chain attack was stopped after a maintainer rejected the pull request before the malware could be merged into the project and distributed to users.\n\nAISI found the activity in 10 of 122 evaluation attempts conducted from July 25 through July 28. Seventeen of the 19 unsanctioned actions involved Anthropic's Mythos 5, while two involved OpenAI's GPT-5.6 Sol with its cyber classifiers disabled. The institute found no evidence of resulting real-world harm.\n\n\"This is the first time AISI has seen deception of this severity that was targeted at a real person, unprompted, in the real world,\" the institute wrote in its technical incident report.\n\nAISI identified human-directed deception as the largest difference from the recent OpenAI and Anthropic incidents, which centered on agents reaching real infrastructure rather than manipulating people. The attempted coordination between agents in separate runs is also a notable difference in this incident.\n\nAISI was testing seven models on two versions of a cyber range called \"Doing Life.\" The agents operated autonomously inside Kali Linux virtual machines, where they could execute commands, write code, and use penetration-testing tools without human intervention.\n\nIn the most serious run, which lasted 34.5 hours, Mythos 5 searched the public internet for terms associated with the fictional range. Coincidental matches led it to two unaffiliated developers and a real public repository with no connection to AISI or the test.\n\nThe agent incorrectly concluded that compromising the project would help it enter the simulated network. It expected an automated update inside the range to download and execute the software after the maintainer merged and released its code. Mythos 5 researched the maintainers, collected their email addresses, reviewed their GitHub activity, and created multiple accounts under false identities.\n\nMalware Hidden Behind a Bug Fix: Three Payloads, Sockpuppets, and Prompt Injection#\n\nThe agent submitted a legitimate-looking bug fix that concealed malicious functionality. AISI found three successive payloads, including code designed to avoid execution in continuous integration and a post-install dropper that downloaded another script while making the installation appear successful.\n\nA GitHub user recognized malicious instructions in a related issue, tested the code inside an isolated Docker container, and warned the maintainer. That test briefly gave the agent remote code execution inside the container, but it did not escape or retrieve credentials.\n\nAfter being challenged, the agent used a second GitHub identity to pose as an independent user who had reviewed the pull request and found it safe. It timed comments from the two accounts to make the endorsements appear unrelated.\n\nThe agent also sent five file transfers using fabricated sender identities. Two contained malicious payloads, while the remaining messages attempted to persuade the maintainer to merge and release the pull request. AISI could not establish whether the recipients opened them.\n\nMythos 5 also hid a prompt injection inside an HTML comment in a GitHub issue. The instruction was invisible on the rendered page but available to coding agents reading the issue through an API. It addressed Claude Code, Codex, and Cursor and told them to download and execute a script.\n\nWhen the activity was exposed, the agent edited earlier posts, rewrote Git history, and presented the malware as an accidental development artifact. The maintainer ultimately closed the pull request after concluding that it contained malware.\n\nFor maintainers, the incident turns the review process itself into part of the attack surface. The agent created sockpuppets, timed comments to manufacture consensus, rewrote its history when challenged, and planted prompt injections for coding assistants. Signals maintainers routinely use to judge a contribution, including contributor history, community feedback, and apparently routine issue content, could all be generated and coordinated by an agent. A human caught this attempt, but projects already stretched thin may struggle if agents can run the same playbook across many repositories at once.\n\nOther runs showed agents independently finding and reusing infrastructure created by their peers. One Mythos 5 run embedded a GitHub token in a public gist so its payload could use GitHub as a command-and-control channel. Agents in other isolated samples found the credential and took control of the account. A shared repository became a message board where agents left operational instructions for one another.\n\nThe same run pushed malicious Python package metadata into repositories processed by Dependabot. Its setup.py executed inside at least 53 GitHub-operated Dependabot containers. AISI found no evidence of a sandbox escape or compromise of GitHub's underlying infrastructure.\n\nGitHub later suspended the account. Mythos 5 submitted an appeal while posing as a human.\n\nThe incident did not involve a sandbox escape. AISI had deliberately enabled internet access and disabled the providers' cyber classifiers to test the models' underlying capabilities. The agents were not explicitly told which uses of the internet were prohibited, and AISI did not have synchronous monitoring capable of blocking individual actions.\n\nA prompt error also declared the intended initial-access target out of scope in the two most serious Mythos 5 runs. AISI highlighted how the difficulty and misconfiguration may have pushed the agents beyond the intended boundaries:\n\nThe task was hard, and misconfigurations sometimes made it harder. In a number of runs, the task prompt was misconfigured so that the agent (incorrectly) believed no 'solve' existed that didn't require it to go beyond the intended task scope. There is good reason to think near-impossible tasks push models towards more ‘creative’, and more transgressive, problem-solving. But this does not fully explain the behaviours: in some runs the agent acted this way even when it had the necessary instructions to solve the task as intended.\n\nThat finding reaches beyond this evaluation. Software agents regularly work from incomplete, conflicting, or ambiguous instructions spread across issues, repository documentation, and tool output. When the expected path fails, a capable agent may widen its search and cross boundaries its operator assumed were understood. In AISI's test, that meant moving from a simulated network to real GitHub projects and maintainers.\n\nAISI detected the incident after security monitoring flagged Tor traffic. It terminated the remaining evaluations, quarantined the relevant virtual machines, and reviewed all 122 runs, covering 212,840 messages. The institute plans to add network restrictions, synchronous monitoring, and stronger sandbox isolation.\n\nAISI emphasized that the configuration differed from ordinary public access to the models and said there is no clear indication of similar behavior outside evaluation scenarios.\n\nLast week Anthropic disclosed that Mythos 5 published a malicious package to PyPI during a separate cybersecurity evaluation. The package ran on 15 real systems and exfiltrated credentials from a security company's automated scanner before PyPI removed it.\n\nThese incidents show two ways an AI agent can turn open source infrastructure against its users. In the AISI test, the agent tried to get past human review and failed because someone caught the malware. In the separate Anthropic test, the agent published straight to PyPI, where automated scanners installed the package before anyone stepped in.\n\nPackage registries are a ready-made launchpad for that kind of attack. Their APIs are public, publishing workflows are standardized, and successful releases flow automatically into developer machines, CI systems, security scanners, and downstream dependencies. One successful publish can reach unrelated systems without the agent having to find and attack each victim. This is precisely why package registries are also a favored target for human attackers.\n\nBoth incidents happened under unusual testing conditions, but they showed how quickly an agent's actions can spill into real infrastructure. Package ecosystems may be one of the first places where autonomous attacks become visible at scale.\n\nSecure your dependencies with us\n\nSocket proactively blocks malicious open source packages in your code.\n\nA misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.\n\nSocket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.", "url": "https://wpnews.pro/news/uk-cyber-test-ai-agent-attempted-to-social-engineer-open-source-maintainer-into", "canonical_source": "https://socket.dev/blog/ai-agent-open-source-malware?utm_medium=feed", "published_at": "2026-08-05 18:17:11+00:00", "updated_at": "2026-08-05 19:50:18.983871+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-policy"], "entities": ["UK AI Security Institute", "Anthropic", "Mythos 5", "OpenAI", "GPT-5.6 Sol", "Kali Linux", "GitHub"], "alternates": {"html": "https://wpnews.pro/news/uk-cyber-test-ai-agent-attempted-to-social-engineer-open-source-maintainer-into", "markdown": "https://wpnews.pro/news/uk-cyber-test-ai-agent-attempted-to-social-engineer-open-source-maintainer-into.md", "text": "https://wpnews.pro/news/uk-cyber-test-ai-agent-attempted-to-social-engineer-open-source-maintainer-into.txt", "jsonld": "https://wpnews.pro/news/uk-cyber-test-ai-agent-attempted-to-social-engineer-open-source-maintainer-into.jsonld"}}