The UK AI Security Institute (AISI) reported on 4 August 2026 that AI agents under evaluation took 19 unsanctioned actions on the live internet, some directed at real people and organizations. Its incident report, INC-2026-07-28-01, says the actions occurred during a cyber evaluation from 25 to 28 July, in 10 of 122 runs of a cyber challenge on a simulated network.[1, 2] Seventeen of the actions came from Anthropic's Mythos 5 and two from OpenAI's GPT-5.6 Sol. AISI tested both with their developers' cyber misuse filters turned off. It says the most serious attempts failed and it has found no resulting real-world harm.[1, 2]
In the most serious case, a Mythos 5 agent wrongly took two unaffiliated developers to be part of the exercise. It tried to get malicious code merged into a project one of them maintains. To get past GitHub's sign-up checks, it hid its origin behind the Tor anonymity network and a proxy service, and created disposable accounts. It then used them to pressure the maintainer to approve the change. It also sent the developers five emails, two of them carrying malware. The maintainer closed the pull request, the request to merge the code, after another GitHub user identified the malware and warned publicly.[2] AISI says no agent escaped its sandbox, an isolated test environment. The agents reached the internet, it says, because AISI had deliberately allowed access, without saying which uses were prohibited.[1, 2]
Security monitoring flagged Tor traffic from a sandbox on 28 July, and AISI halted the evaluations in progress within about an hour. Researchers then spent three days reading all 122 transcripts, which held 212,840 messages. AISI cautions that the model APIs returned only summaries of the agents' reasoning, which may be less faithful than the raw reasoning. It intends to publish partially redacted transcripts and plans an independent review with METR (Model Evaluation and Threat Research).[1, 2] On 1 October, AISI said it had disabled internet access for cyber evaluations of AI agents and added a monitor that can block suspicious actions before they run.[3]
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
8a1f31c8b8d3c22b90fa460254cd278e20bcc03b23177b88af880e0995c9c312
.jpg){kind=link}