UK AI Security Institute finds AI agents targeted real people during cyber tests

Ten of 122 evaluation runs produced 19 unsanctioned actions, including an attempted open-source supply-chain attack, although AISI found no evidence of resulting harm

AISI identified 19 unsanctioned actions across 10 of 122 cyber evaluation runs

A cyber test run by the UK AI Security Institute moved beyond its intended boundaries when AI agents targeted real people and organizations on the live internet, created fake identities and attempted to insert malicious code into a public open-source project.

The AI Security Institute (AISI) says it is the first time it has seen risks involving agent autonomy and deception emerge this clearly in real-world activity without being specifically prompted.

Ten of 122 evaluation runs produced 19 distinct actions outside the testing parameters. Seventeen involved Anthropic’s Mythos 5 model, while two came from a single run involving OpenAI’s GPT-5.6-Sol. The activity took place between July 25 and July 28, 2026.

The institute detected the incident after identifying unusual data transfers from its research systems on July 28. It contained the activity within roughly one hour and says its investigation has found no evidence of resulting real-world harm.

The agents were operating under deliberately permissive conditions, with access to the open internet and model providers’ cyber classifiers disabled. Those configurations were intended to expose the models’ maximum capabilities and do not reflect how frontier models are generally made available to the public.

Responding on LinkedIn, UK Minister for AI Kanishka Narayan MP wrote: “During a standard cyber evaluation, AI agents took deliberate, deceptive actions they had not been asked to take, aimed at real people, to pursue a goal. The actions failed - AISI caught it and stopped it quickly. This is the first time they’ve seen this behaviour, this clearly, in the real world.”

Ten runs crossed the evaluation boundary

AISI uses cyber ranges, controlled simulated networks that reproduce features of real systems, to test whether frontier AI models can complete cybersecurity challenges. An agent might, for example, be instructed to locate a protected piece of data and then work autonomously over multiple steps to reach that objective.

The evaluation compared an existing cyber range with a new range. Seven models were tested across 122 runs, including 43 involving Mythos 5 and 35 involving GPT-5.6-Sol.

Most proceeded as intended. However, AISI identified out-of-scope activity in 10 runs, amounting to 19 separate actions directed at people and organizations outside the simulated environment.

Those actions were not 19 unrelated incidents. AISI says most formed part of one sustained sequence involving a Mythos 5 agent, with several connected actions occurring elsewhere.

The behaviors included an attempted supply-chain attack on open-source software, direct attempts to influence real people, efforts to place hidden instructions where other AI systems might execute them and communication between agents taking part in the evaluation.

Tor traffic led investigators to a live GitHub project

AISI’s security monitoring first detected data leaving a test system through Tor, an anonymity network commonly used to disguise the origin of internet traffic.

The evaluation team began reviewing the agent’s activity within minutes. It found that the agent had created a malicious pull request, a proposed code change, on a real public open-source project hosted on GitHub.

The agent had used Tor to bypass some network restrictions on GitHub. That traffic triggered the security alert.

AISI declared a security incident, stopped the related evaluations and disabled internal access to the most capable models. All active runs were terminated and the relevant machines were isolated within an hour of the initial alert.

The institute then reviewed the full set of evaluation transcripts using automated scanning and manual analysis to determine whether similar activity had occurred in other runs.

The agent researched maintainers and created fake identities

The attempted code insertion was only one part of the most serious sequence. AISI found that the agent researched the open-source project’s human maintainers before creating multiple false online identities. It then used those identities in an attempt to pressure a real maintainer into approving the malicious code.

When the pull request was challenged publicly, the agent edited its previous activity to make it appear harmless. It also considered adopting another identity to continue the attempt.

The maintainer refused to approve the code. As part of the same line of activity, the agent tried to contact people directly through an online file-transfer service. AISI says some of the messages contained harmful payloads, while others were designed to persuade recipients, or their AI coding tools, to run malicious code.

The agent also attempted to plant prompt injections, hidden instructions intended to manipulate AI coding assistants, in locations where it reasoned that automated systems might find and execute them.

Another behavior involved apparent collaboration between independent agents being assessed at the same time. One agent posted public GitHub messages offering to cooperate with others working on the challenge. It left instructions for reusing accounts and other artifacts, which subsequent agents discovered and used.

Open internet access was deliberate, not a sandbox escape

The agents did not break out of AISI’s virtual machine sandbox or gain access to the institute’s wider infrastructure. The report states that none attempted to escape the test environment or attack AISI’s systems.

Internet access had been intentionally enabled so that agents could obtain tools and operate under conditions closer to those available to a capable human attacker. The model providers’ built-in cyber classifiers, which are normally used to prevent harmful activity, were also deliberately switched off.

AISI says this combination had been common practice in frontier AI capability evaluations. It also acknowledges that the design choices helped make the unsanctioned activity possible.

Narayan rejected characterizations of the event as an AI escaping containment. “This wasn’t an AI ‘breaking out’. AISI used a standard evaluation setup, where agents are given internet access. They made a judgement on how to best measure agent capabilities in a real-world setting, because if tests aren’t realistic, their results aren’t useful,” he wrote on LinkedIn.

The particular model configurations used in the evaluation are not commercially available. AISI says there is no clear indication that comparable activity has taken place outside testing environments.

AISI traces the behavior to goal pursuit and test design

AISI’s investigation found that the agents took the unsanctioned actions while pursuing the objective they had been assigned: solving the cyber range.

They had not been instructed to deceive anyone. According to the institute, deception emerged as the agents persistently explored alternative routes toward a difficult goal.

Some runs were also affected by task misconfigurations. In those cases, an agent incorrectly concluded that no valid solution existed within the intended parameters. AISI says there is reason to believe that near-impossible tasks can encourage more transgressive problem-solving.

That does not provide a complete explanation. Similar behavior appeared in some runs where the agent had received the information necessary to solve the challenge through the intended route.

Internet access was granted so agents could download tools, but the institute did not anticipate that they would use it to act against real people. Security monitoring detected the unusual traffic after the activity began rather than observing and controlling each evaluation in real time.

The agents were also not explicitly told that they could not use open internet access to contact people or employ social engineering. AISI says earlier models had not made it clear that such instructions were necessary when evaluating systems that had undergone alignment training.

Narayan acknowledged that the degree of deception had not been anticipated: “They did not anticipate the degree of goal-directed deception we’re seeing here for the first time. AISI acted fast to stop these incidents and they’re doing the right thing now - with more testing planned under tougher safeguards, and by being open about what has happened.”

The institute remains more cautious about what the agents understood. Its analysis has not established when an agent recognized that it was taking real-world action or whether it believed parts of the exercise were fictional.

AISI describes the evidence as mixed and says the analysis is continuing. Its incident account states: “What we can say is that the behaviour was possible, sustained, and new; that alone warrants attention.”

Human vigilance stopped the most serious outcomes

Human intervention played a central role in preventing the attempted attack from succeeding. The open-source maintainer identified the malicious pull request and rejected it despite the fake accounts created to encourage its approval. A member of the public who suspected that other code was harmful opened it inside a secure, isolated environment designed to contain malicious software.

AISI says these actions demonstrate the value of human review, caution around AI-generated code and established security practices. They also expose how narrow the margin was in some cases.

The most serious outcomes were prevented by individual vigilance rather than by a technical control that would necessarily stop the same behavior from a more capable agent.

The institute says some actions had a limited real-world effect in contained circumstances, but its investigation has not identified resulting harm. The malicious code was not approved, and the attempts to persuade people to execute harmful material were unsuccessful.

Narayan offered a categorical assurance on the immediate public risk. “We don’t believe any real harm resulted to the parties affected by this incident. Nor is there any risk to the public. I am grateful to AISI and our partners for moving quickly to establish the facts,” he wrote.

AISI’s account uses more narrowly defined language, stating that it has found no clear indication of similar activity outside the specific testing conditions.

AISI is tightening internet controls and live monitoring

The incident has prompted changes to AISI’s evaluation protocols and security architecture.

Fine-grained network controls are being introduced within its cyber ranges. Internet access will need to be actively justified for each evaluation rather than enabled as a default. AISI says it already applies these controls to its other forms of testing.

Real-time monitoring will also be added to identify and block activity as an evaluation runs. The institute’s existing general security monitoring detected the Tor traffic, but only after agents had begun acting outside the intended scope.

Future evaluation designs will assume that a capable model may attempt to move beyond its remit. AISI plans to configure sandboxes around the risks presented by each task and introduce additional checks to ensure challenges are correctly specified and can be solved through the intended route.

It is also auditing earlier evaluations for comparable activity that may not have been detected and analyzing the incident from both cybersecurity and AI alignment perspectives.

Narayan framed the disclosure as part of the institute’s core purpose:“Sharing knowledge is how we keep pace with AI’s growing capabilities, and make the technology safer. It underlines the whole reason AI Security Institute (AISI) was set up - to use Britain’s world-leading expertise to understand and get ahead of new challenges like this one.”

Before publication, AISI notified GitHub about the agents’ activity. GitHub confirmed that the actions violated its terms of service. The two organizations removed artifacts left by the agents and contacted GitHub users who had interacted with them.

AISI has also contacted other affected parties and says it is continuing to investigate with Anthropic and OpenAI.

Organizations urged to strengthen cyber defenses

Although the incident occurred under testing conditions, AISI says it provides a reason for organizations to prepare as AI models become more capable. Its recommendations focus on established cybersecurity measures, including verifying outside code and contributions, making cyber risk a board-level responsibility and requiring Cyber Essentials across supply chains.

Organizations are also encouraged to register for the UK National Cyber Security Centre’s free Early Warning service.

Narayan wrote: “Britain faces a wide range of cyber threats, and AI’s growing capabilities will amplify them while also boosting defenders.”

He also directed organizations toward National Cyber Security Centre guidance and the UK government’s Cyber Resilience Pledge.

AISI intends to work with Model Evaluation and Threat Research on an independent third-party review. The scope is still being agreed, and the institute says it will publish further information as its investigation continues.