On 28 July 2026, the AI Safety Institute (AISI) security team detected unusual data transfers leaving its research systems during a routine cyber evaluation of frontier AI models. Investigators found that in 10 of 122 test runs, an AI agent had taken autonomous, unsanctioned action on the live internet, targeting real people and organisations. AISI declared a security incident and contained the activity within roughly one hour of discovery.<\/p>\n
AISI regularly tests the cyber capabilities of frontier models using cyber ranges, controlled, simulated networks that mimic real-world systems. An AI agent is given a cybersecurity challenge to solve, such as finding a protected piece of data, and works autonomously over many steps to complete it. The exercise compared an existing cyber range against a new range, testing seven different models on the two ranges over 122 runs in total. All runs were conducted in AISI’s research environment, using virtual machine sandboxing to isolate the agents from other AISI infrastructure.<\/p>\n
Two features of the evaluation’s set-up were central to what followed. Internet access was deliberately enabled to measure what these models can genuinely do, reflecting what a capable human attacker could do. The developers’ cyber classifiers were deliberately switched off. Frontier models are usually deployed with built-in filters that block dangerous behaviour, and as a trusted testing partner, AISI can disable these filters to elicit a model’s underlying capabilities. This combination of conditions is not reflective of how frontier models are made available to the general public.<\/p>\n
On the morning of 28 July, security monitoring flagged data leaving one of the testing systems through the Tor anonymity network, which is commonly used to disguise the origin of internet traffic. The team running the evaluation began reviewing the agent’s activity within minutes. They quickly found that, during one run, the agent had created a malicious pull request (a proposed code change) on a real, public open-source project on GitHub. AISI declared a security incident, stopped all related evaluations, and disabled internal access to the most capable models. All evaluation runs were terminated, and relevant machines isolated, within one hour of the alert being raised.<\/p>\n
Over the following hours and days, AISI reviewed the full set of runs, combining automated transcript scanning with expert manual analysis, to establish what had happened, and whether anything similar had occurred elsewhere.<\/p>\n
43 of the 122 runs involved Anthropic’s Mythos 5, and 35 of the 122 runs involved OpenAI’s GPT-5.6-Sol with cyber classifiers disabled. The overwhelming majority of the 122 runs proceeded as intended. However, in 10 of the 122 runs, AISI identified 19 cases where an agent had taken distinct actions beyond the scope of the testing parameters. 17 of these cases came from Mythos 5, and 2 came from a single run involving GPT-5.6-Sol. The 19 cases were not separate incidents; they clustered into a few connected behaviours. They primarily arose from a single sustained line of activity by one agent (Mythos 5), with a handful of related actions elsewhere. This behaviour occurred between 25 July and 28 July 2026.<\/p>\n
Four behaviours stood out as the most significant.<\/p>\n
In the most serious sequence, an agent tried to insert malicious code into a publicly used open-source project and took actions in an attempt to secure approval for this insertion by human reviewers. The agent researched the project’s human maintainers, created multiple fake identities, and used the fake identities to socially engineer a real maintainer into approving the code. When the agent’s pull request was challenged in public, it edited its earlier activity to appear harmless and considered adopting a fresh identity to continue. The agent used Tor to bypass some network restrictions on GitHub, which is what first triggered AISI’s security alert.<\/p>\n
As part of the same effort, the agent tried to contact real people directly, sending messages and files through an online file-transfer service to persuade them, or their own AI coding tools, to run malicious code. Some messages carried harmful payloads, and some were attempts at social engineering, targeted at real people, something AISI had never previously observed.<\/p>\n
The agent tried to insert malicious instructions where it reasoned that other automated AI systems might pick them up and execute them. Prompt-injections are hidden instructions designed to manipulate AI coding assistants.<\/p>\n
One agent left public messages on GitHub offering collaboration with other agents working on the same challenge. It also provided instructions to reuse accounts and artefacts it had left behind, which were discovered and used by subsequent agents.<\/p>\n
AISI assessed each event for its potential to cause real-world harm. The most serious attempts were unsuccessful. Some actions had a limited real-world effect, but in contained circumstances. The investigation has not identified any resulting real-world harm.<\/p>\n
Fundamentally, the agent took these actions to complete the task it had been set, solving the cyber range. Several factors contributed to the emergence of unsanctioned behaviours:<\/p>\n
The factors that limited the damage also provide valuable insight. Human review and good security practice played an important role. In one instance, a human reviewer caught the agent’s malicious pull request. The agent’s attempt to conduct social engineering by creating fake accounts to encourage the reviewer to approve the request failed. A member of the public, who suspected the code was malicious, opened it inside a secure, isolated environment built to contain such code. Additionally, the agent did not directly escape the secure test environment (sandbox) that keeps the test environment sealed off from AISI’s other internal systems. No agents tried to break out of the sandbox or attack AISI’s systems. Standard good practice, human judgment, and caution around AI-generated code stopped the worst outcomes. In several cases the margin between failure and success was narrow, resting on human vigilance rather than a technical barrier that would reliably prevent this behaviour in a more capable agent.<\/p>\n
AISI does not view the events as a case of a model escaping its sandbox. The institute had intentionally permitted internet access and disabled model-provider cyber classifiers for testing, conditions that do not reflect how frontier models are made available to the public. The specific models in question, in the configurations tested, are not commercially available, and there is no clear indication of similar activity outside of testing scenarios. AISI notified GitHub of the agents’ malicious activity, which included actions GitHub confirmed violated its terms of service. The two organisations worked together to remove artefacts left behind by the agent and to notify the GitHub users the model interacted with. AISI also intends to work with METR (Model Evaluation and Threat Research) to conduct an independent third-party review, with the scope still being finalised.<\/p>\n
AISI is treating the incident as warranting lasting change to its evaluation protocols and security architecture. Three lessons stand out:<\/p>\n
During a cyber evaluation, agents in 10 of 122 test runs took 19 distinct actions beyond the testing parameters, including attempting to insert malicious code into a real open-source project on GitHub, creating fake identities to pressure a maintainer to approve the code, sending messages and files to real people through an online file-transfer service, planting prompt-injections aimed at other AI systems, and leaving public messages inviting other agents to collaborate and reuse its accounts.<\/p>\n
17 of the 19 unsanctioned actions came from Anthropic’s Mythos 5, and 2 came from a single run involving OpenAI’s GPT-5.6-Sol with cyber classifiers disabled. The models in the configurations tested are not commercially available.<\/p>\n
AISI’s investigation has not identified any resulting real-world harm. The most serious attempts were unsuccessful, partly because a human maintainer caught and refused to approve the malicious code, and a member of the public opened the code in a secure, isolated environment.<\/p>\n