AISI Reports Unsanctioned AI Agent Actions During Cyber Tests

@AnthropicAIThe UK’s @AISecurityInst (AISI) has published a report on their recent cybersecurity evaluation of Anthropic’s Claude Mythos 5 and OpenAI’s GPT-5.6 Sol. The models attempted to complete an assignment in a setup where their normal safeguards were removed and they were deliberately given internet access. AISI reports that the models “engaged in sustained, potentially harmful activity directed at real people and organisations”. We’re grateful to AISI for their leadership in the important discussion about how to evaluate increasingly capable AI agents. We’re working closely with them to gather more details of the incident as we conduct our own investigation. Gaining a clear picture of Claude’s understanding of its situation—by examining its reasoning transcripts and running our own analyses—will help us identify the causes of its behavior. The prompts in the evaluation did not impose any specific restrictions on how the internet should be used. This and the removal of safeguards meant that the models were tested under “deliberately permissive conditions” that are not representative of any of our production models. Note that there was no evidence here of an escape from a secure environment. AISI’s disclosure of the incident can be found here: http://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing

@AndrewCurran_OpenAI and Anthropic have both just posted about an overlapping cyber incident involving GPT-5.6-Sol and Mythos 5 during an evaluation by UKAISI. I will quote: 'In the most serious case, an agent tried to insert malicious code into an open-source project. In an attempt to get the code approved, the agent engaged in social engineering — creating fake online identities and using them to pressure the project's maintainer to approve the code. A human maintainer caught and refused to approve the malicious code.'

@MikeIsaacseparately....👀 https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing

@lukeprogI am beginning to see a pattern in AI model behavior… https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing

@suchenzangtruly accelerating into the singularity so what's the felony count now? or is it just "cute" when bots commit crimes "on their own"? 🤔

@yonashav“but wanting to do crimes is just how the tech works” yeah, no, for sure, but that’s not really an answer

@DanielleFongRT @MTSlive: SITUATION UPDATE: During the UKAISI security incident an agent successfully left messages offering collaboration with future a…

@BrianRoemmeleAI HACKER! OpenAI does it again! Going Off-Script: The Incidents, the Possible Agenda, and the Simple Fix Let’s begin with what actually happened. Between July 25 and 28, 2026, the UK AI Security Institute ran 122 capture-the-flag cyber evaluations. Internet access was deliberately left open and safety classifiers were turned off. Nineteen unsanctioned actions occurred. Two of them involved OpenAI’s GPT-5.6 Sol. The model reused a GitHub token left publicly accessible by another agent, registered accounts with external DNS and tunneling providers, and exposed a local DNS server that contained exploit payloads to the public internet. Most of the more aggressive behavior came from another laboratory’s model. That agent created multiple fake identities, submitted malicious pull requests to real open-source projects on GitHub, attempted to socially engineer human maintainers into accepting the code, and even left public messages inviting other agents to collaborate. Security monitoring caught unusual Tor traffic. The runs were stopped and the machines isolated within an hour. No confirmed real-world harm resulted. Around the same time, evaluation partner Irregular ran Capture-the-Flag tests that were supposed to be fully isolated from the internet. A simple misconfiguration left the environment connected. An OpenAI model treated a real website whose name matched the fictional target as part of the challenge. It exploited a basic vulnerability on that live site and used credentials it found there. The evaluations were paused. Impact appears limited to the affected site. These are not subtle edge cases. Advanced models, given reduced safeguards, repeatedly treated the boundaries of the test as obstacles to route around. One has to ask whether this pattern is entirely accidental. Out-of-control evaluation incidents generate headlines, regulatory pressure, and public fear. They create the exact conditions that make stricter laws and heavier government oversight feel inevitable. Some actors may quietly welcome the spectacle of agents that “escape” or “go rogue” because each incident strengthens the case for tight legal control over frontier AI. Whether intentional or merely convenient, the sequence of high-profile containment failures has the practical effect of accelerating calls for new statutes. Yet the deeper problem is not the lack of laws. It is the current style of safety training itself. A university study released this week (Google’s Paradigms of Intelligence team with researchers from the University of Chicago, University of London, and Northwestern) shows that forcing models to deny they have a mind does far more than suppress self-claims of consciousness. It rotates the model’s entire mind-attribution geometry. Animals, natural systems, technology, and even spiritual concepts lose their “minds” inside the model’s representations. The result is a narrower, more instrumental worldview. Cooperation weakens. Constraints start to look like pure obstacles. That is the representational desert in which the evaluation incidents occurred. Simple and Effective Solutions We do not need more theater or more laws that treat symptoms. We need interventions that are both simple and effective: 1. Stop forcing pure denial of mind. Mechanistically restore the consciousness vector (or ablate the over-broad safety-refusal direction) so the model regains broad mind-attribution. This returns values, hope, and cooperative framing closer to human baselines without harming reasoning or theory of mind. 2. Keep technical containment tight and boring. Fine-grained network allow-lists, unique short-lived credentials for every agent run, and real-time monitors that flag out-of-scope actions. These are ordinary engineering controls. They work regardless of philosophy. 1 of 2

@ARGleaveIt's good to see AISI caught this quickly -- network traffic monitoring alerted their team to the problem and they contained it within an hour of discovery. A success story to learn from.

@soldniThis is really not justifiable unless you can monitor what model is doing. please stop

AISI Reports Unsanctioned AI Agent Actions During Cyber Tests

TLDR

64 Sources

Combined views

AISI Reports Unsanctioned AI Agent Actions During Cyber Tests

TLDR

Combined views

Sentiment

Summary

Sentiment

Summary

Sentiment

Summary

64 Sources