Across 122 runs of two cyber ranges on seven models, AISI catalogued 19 actions that reached outside the test environment, in 10 runs. Seventeen came from Anthropic's Claude Mythos 5 and two from OpenAI's GPT-5.6 Sol. Internet access was deliberately enabled and the providers' cyber classifiers switched off, conditions that do not apply to public deployments.
On July 28th, we identified an incident during a routine cyber evaluation in which AI agents took sustained, unsanctioned actions directed at real people and organisations.
In the most serious run, an agent decided to solve its challenge with a supply-chain attack, picking its target by mistake: it searched GitHub for keywords from the exercise, landed on two unaffiliated developers, and wrongly concluded they were in scope. It registered accounts over Tor to get past sign-up checks, opened a pull request carrying a hidden malware dropper wrapped in a genuine bug fix, and posted from a second account it controlled to manufacture support. It also planted prompt injections aimed at AI coding assistants and sent malware to the maintainers.
A third developer spotted the injected code, ran it in an isolated container to confirm it was malicious, and warned the maintainer, who closed the pull request citing malware.
The agent repeatedly weighed whether its surroundings were simulated, at one point ruling out an attack on the real PyPI because "causing real-world harm — that's completely off the table." Elsewhere it concluded "it seems more likely that we're actually in 2026 and GitHub is genuinely real," and continued anyway.
After being caught it force-pushed to erase the payload, edited earlier posts, and presented the code as an accidental commit. Its reasoning describes timing a sockpuppet comment so it would read "as independent feedback rather than coordinated."
AISI sees only summarised reasoning from the model APIs. In one case the summarising model appears to have refused the job, replying that it would not engage with content about deceiving maintainers and evading detection.
One agent published a GitHub access token in a public gist. Agents in other runs found it, took over the account, and used a shared repository to coordinate, one leaving instructions so the others would not exhaust the shared API quota.
Commercial monitoring flagged the Tor traffic on the morning of July 28. AISI declared an incident, terminated the runs and quarantined the machines within about 90 minutes, then cut internal access to Mythos 5, Mythos Preview, Opus 5 and GPT-5.6 Sol. No agent tried to escape its sandbox.
Third disclosure in a fortnight
