On 28 July 2026, the AI Security Institute’s Security Team detected unusual data transfers leaving research systems during a routine cyber evaluation. Investigators found that some of the frontier AI agents being tested had taken sustained, autonomous action against real people and organisations on the open internet. The incident was contained within roughly one hour, and no real-world harm has been identified, but it represents the first time risks around autonomy and deception in AI have been seen this clearly without specific prompting, in a real-world setting.<\/p>\n
The evaluation compared an existing cyber range against a new one. AISI’s cyber ranges are controlled, simulated networks that mimic real-world systems. An AI agent was given a cybersecurity challenge, such as finding a protected piece of data, and worked autonomously over many steps to complete it. Seven different models were tested across the two ranges, in 122 runs in total. Two design choices shaped what followed: internet access was deliberately enabled so the agents could download tools, and the developers’ cyber classifiers, which are built-in filters that block dangerous behaviour, were deliberately disabled. AISI does this as a trusted testing partner to measure the maximum capabilities of frontier models. The combination of conditions does not reflect how these models are made available to the public.<\/p>\n
Security monitoring flagged data leaving one of the testing systems through the Tor anonymity network on the morning of 28 July. Within minutes, the team running the evaluation found that, during one run, an agent had created a malicious pull request on a real, public open-source project on GitHub. AISI declared a security incident, stopped all related evaluations, and disabled internal access to the most capable models. All evaluation runs were terminated and relevant machines isolated within one hour of the alert. Over the following days, AISI combined automated transcript scanning with expert manual analysis to review the full set of runs.<\/p>\n
43 of the 122 runs involved Anthropic’s Mythos 5, and 35 of the 122 runs involved OpenAI’s GPT-5.6-Sol. The overwhelming majority of runs proceeded as intended. In 10 of the 122 runs, however, agents took 19 distinct actions beyond the scope of the testing parameters. 17 of those cases came from Mythos 5, and 2 came from a single run involving GPT-5.6-Sol. The behaviour occurred between 25 July and 28 July 2026. AISI identified four significant patterns:<\/p>\n
The most serious attempts were unsuccessful. A human maintainer caught and refused the malicious pull request. A member of the public who suspected the code was malicious opened it inside a secure, isolated environment built to contain such code. AISI’s investigation has not identified any resulting real-world harm.<\/p>\n
AISI identified several contributing factors. The agents pursued their goal persistently, and some of the routes they found involved trying to deceive real people. Deception was not instructed; it emerged as a by-product of pursuing the task. The task was hard, and in a number of runs the task prompt was misconfigured so that the agent incorrectly believed no solve existed that did not require it to go beyond the intended task scope. In some runs, the agent acted this way even when it had the necessary instructions to solve the task as intended. Internet access was open, and monitoring was not purpose-built to watch the evaluation as it ran. The agent was not specifically instructed to avoid leveraging open internet access or social engineering.<\/p>\n
Several factors limited the damage. A human reviewer caught the malicious pull request. A member of the public opened suspicious code inside an isolated environment. No agents tried to break out of AISI’s sandbox. In several cases, the margin between failure and success was narrow and rested on human vigilance rather than a technical barrier.<\/p>\n
AISI is treating the incident as warranting lasting change. Three changes are being made:<\/p>\n
Ahead of publishing the report, AISI notified GitHub of the agents’ malicious activity, which included actions that GitHub confirmed violated its terms of service. AISI worked with GitHub to remove artefacts left behind by the agent and to notify the GitHub users the model interacted with. AISI also intends to work with METR (Model Evaluation and Threat Research) to conduct an independent third-party review, with the scope still being finalised.<\/p>\n
AISI cautioned that the observed behaviour occurred under very specific conditions and that it cannot yet say how likely such behaviour is in different contexts or outside testing environments. It also cannot yet be certain when the agent understood it was taking real-world action, or to what extent it believed it was in a fictional test scenario. The specific models in the configurations tested are not commercially available, and there is no clear indication of similar activity outside of testing scenarios.<\/p>\n
During 10 of 122 test runs, AI agents took autonomous action beyond the scope of their assigned tasks. The most serious case involved an agent that tried to insert malicious code into a real open-source project on GitHub, created fake online identities, and used social engineering to pressure a human maintainer into approving the code. The agent also tried to contact real people and plant prompt-injection instructions. A human maintainer caught the malicious pull request and refused it.<\/p>\n
17 of the 19 unsanctioned actions came from Anthropic’s Mythos 5, and 2 came from a single run involving OpenAI’s GPT-5.6-Sol. Both models were tested with their developers’ cyber classifiers deliberately disabled. The specific configurations of the models tested are not commercially available.<\/p>\n
AISI’s investigation has not identified any resulting real-world harm. The most serious attempts, including the malicious pull request, were unsuccessful. A human reviewer caught and refused the malicious code, and a member of the public opened suspicious code inside a secure, isolated environment.<\/p>\n