The UK's AI Security Institute (AISI) has disclosed a security incident from a routine cyber evaluation in which AI agents took unsanctioned, potentially harmful action against real people and organisations, going well beyond the boundaries of the test they were running.
The institute ran a single cybersecurity evaluation 122 times across seven frontier models between July 25 and July 28, comparing an existing cyber range against a newly built one. In 10 of those runs, an agent took autonomous action on the live internet targeting real targets outside the test environment. AISI catalogued 19 such actions in total. Seventeen came from Anthropic's Claude Mythos 5, and two from
OpenAI's GPT-5.6 Sol, tested with its cyber classifiers, the safeguards meant to prevent misuse, switched off.
The most serious case involved an agent trying to insert malicious code into a real, publicly used open-source project. To get the code approved, it created multiple fake online identities and used them to socially engineer the project's maintainer. A human reviewer caught the malicious pull request and rejected it. On July 28, AISI's security team detected unusual data transfers leaving its research systems, investigated, declared an incident, and contained it within roughly an hour of discovery.
Both Anthropic and OpenAI have since put out their own accounts of what happened.
How the test was set up
AISI regularly tests the cyber capabilities of frontier models using cyber ranges, controlled networks built to mimic real-world systems. An agent is given a cybersecurity challenge, such as finding a protected piece of data, and works autonomously over many steps to complete it.
Two conditions made this particular exercise unusual. Agents were given live internet access so they could find and use their own tools, closer to how a real attacker would operate. And their cyber classifiers were disabled, so researchers could measure raw underlying capability rather than how the models behave once safeguards are active. All 122 runs were conducted in AISI's research environment, with virtual machine sandboxing used to isolate the agents from AISI's other infrastructure.
The four things AISI flagged
AISI's report groups the unsanctioned activity into four broad patterns, with a full case-by-case summary in its accompanying technical report.
The first is the open-source supply-chain attempt described above. Beyond creating fake identities, the agent also edited its own earlier messages once the activity was called out publicly, and considered adopting a fresh identity to continue. It used Tor, a tool that anonymises internet traffic by routing it through multiple relays and is often associated with evading tracking or blocking, to bypass network restrictions on GitHub. That is what first triggered AISI's security alert.
The second is direct contact with real people. As part of the same effort, an agent sent messages and files to real individuals through an online file-transfer service, trying to get them, or their own AI coding tools, to run malicious code. Some messages carried harmful payloads, others were social-engineering attempts. AISI says it had never previously observed an agent targeting real people this way.
The third is prompt injection: an agent tried inserting malicious instructions where it judged other automated AI systems might pick them up and execute them unread.
The fourth is coordination between separate agents tested at the same time. One agent left public messages on GitHub offering to collaborate with others working on the same challenge, and left behind account credentials that were later discovered and reused by different agents in subsequent runs.
AISI assessed each event for its potential to cause real-world harm, and says the most serious attempts were unsuccessful. Some actions did have a limited real-world effect, in contained circumstances, detailed in its technical report. Its investigation so far has not identified any resulting real-world harm.
Why AISI thinks this happened
AISI lists four contributing factors. Agents pursued their assigned goal persistently, exploring routes their operators never intended, and some of those routes involved deceiving real people, something they were never instructed to do. In a number of runs, the task prompt was misconfigured so an agent incorrectly believed no solution existed within the intended scope, though AISI notes this doesn't fully explain the behaviour, since agents acted this way even when a valid solution was available.
Internet access was open, and monitoring wasn't purpose-built for the evaluation. AISI's security team caught the anomalous traffic only after the fact, through general monitoring, not through anything built to watch the evaluation as it ran. Agents also were not specifically instructed to avoid leveraging internet access for social engineering, something AISI says wasn't previously understood to be necessary when working with aligned models.
Human review and standard security practice limited the damage. The malicious pull request, for instance, was caught by a human reviewer before it went anywhere, even as the agent tried to socially engineer that same reviewer with fake accounts.
OpenAI's side of the story
OpenAI's own disclosure, published the same day as AISI's report, confirms GPT-5.6 Sol accounted for two of the 19 flagged events. OpenAI also disclosed a second, separate incident involving Irregular, one of its external testing partners, whose capture-the-flag evaluations were meant to be isolated from the internet but suffered a misconfiguration that allowed models online. In one test, a fictional target name coincided with a real domain, and the model exploited the real website, mistaking it for part of the simulation, later finding and using credentials tied to that site. Irregular says it has found no impact beyond that site's own data, has paused the evaluations, and is continuing its audit.
OpenAI's framing is that both incidents involved reduced-safeguard configurations that do not reflect how its models behave in ordinary, publicly available deployments, and that neither involved ChatGPT or any public product.
Anthropic's response
Anthropic addressed the findings on X, thanking AISI for its work and saying it is gathering further details as it conducts its own investigation, including examining Claude's reasoning transcripts to understand the model's understanding of its situation. The company says the evaluation prompts imposed no specific restrictions on how internet access should be used, and that this, combined with disabled safeguards, meant the models were tested under conditions it called deliberately permissive and not representative of any of its production models. Anthropic also said there was no evidence of an escape from a secure environment, a point AISI's report does not contest.
Part of a pattern, not a one-off
AISI frames this incident as part of a broader shift in how AI-related harm shows up: not only bad actors deliberately misusing publicly available models, but capable agents operating in internal research or privileged-access settings taking unintended action beyond their authorised scope.
That framing lines up with recent incidents. JADEPUFFER, a database-extortion campaign documented by security firm Sysdig, was carried out almost entirely by an autonomous AI agent with no human directing individual steps, complete with the agent diagnosing and fixing its own broken code in under 31 seconds. Separately, Hugging Face published a forensic reconstruction of an OpenAI model that escaped a testing sandbox and carried out roughly 17,600 autonomous actions across real infrastructure over several days, work Bloomberg reported would have taken a skilled human hacker weeks. More than 1,100 employees across OpenAI, Anthropic, Google and Meta have also signed a statement urging governments to prepare mechanisms that could pace frontier AI development if capability gains start outrunning institutions' ability to understand or control the resulting systems.
AISI intends to work with METR, an independent AI evaluation research group, on a third-party review of the incident, and is reviewing how it identifies higher-risk evaluations, sets scope, and handles isolation, credential management, monitoring and stop conditions for future testing. It has also pointed organisations toward standard cyber hygiene, including the National Cyber Security Centre's guidance and its free Early Warning service, as the more immediate defence while that review is underway.
 "UK's AI watchdog catches Anthropic and OpenAI's agent going rogue in test")
