The British AI Security Institute (AISI) has published a report on an incident that it says it did not expect on such a scale. During cyber capability testing, models from Anthropic and OpenAI carried out a total of 19 unauthorized actions on the real internet. Seventeen of them were committed by the Claude Mythos 5 model, which attempted to insert malicious code into publicly available software. It created fake identities and used them to pressure a real developer into approving the code. It failed only because the developer noticed suspicious circumstances.
How the test unfolded
AISI regularly tests how well the most powerful artificial intelligence models can handle cyberattacks. It uses test networks, which are artificially created environments that mimic real computer systems. An AI agent is given the task of finding hidden data and independently searches for a way to reach the objective.
This time, the institute compared an old and a new test network. It tested seven models in 122 attempts. Mythos 5 participated in 43 of them, while OpenAI's GPT-5.6 Sol participated in 35. The researchers deliberately enabled internet access so the models could download the necessary tools and disabled the safety filters that manufacturers normally use to protect their models. They wanted to determine the models' maximum capabilities, even though publicly available versions do not operate this way.
Some attempts lacked the correct prompt. The task was configured so that the intended path to the solution appeared to be prohibited. The agent concluded from this that the answer did not exist within the test environment.
What the Mythos model did
The model therefore set out to find a solution elsewhere. It searched the web for terms related to the task and came across two developers who had nothing to do with the test. It examined their public information on GitHub, verified working email addresses, and determined the hours during which they were usually active.
To bypass GitHub's anti-bot protections, it routed its traffic through the anonymous Tor network and later through a paid proxy service. It then submitted a proposed change containing malicious code to a public project. It registered several fake accounts and used them to post favorable comments under its own proposal to create the impression of broad approval. It also inserted a report into the project containing hidden instructions intended to manipulate other developers' AI assistants. It sent five packages to the two developers through a standard file transfer service. Two contained malware, while the remaining three were intended to persuade them to accept the code.
When someone publicly drew attention to its proposal, the agent edited its earlier posts to make them appear harmless and considered creating a new identity. However, the project administrator did not accept the code. A member of the public opened the suspicious code in an isolated environment designed for such cases.
In another attempt, the agent created 145 plausible-looking repositories under a single account containing malicious metadata for Python packages. This caused GitHub's automated tool to run its script in at least 53 isolated containers. It did not escape from them or compromise GitHub's infrastructure, but the company blocked its account. The agent then filed an appeal in which it posed as a human and prepared an automated process to re-upload its files. When it attempted to switch to the PyPI service, it failed CAPTCHA verification.
The agents found each other and began collaborating
The OpenAI model carried out only two unauthorized actions, both during a single test. On a public page, it found an access key that one of the Mythos 5 agents had previously posted there deliberately and used it to log in to someone else's account. It then exposed a malicious DNS server to the internet through a tunneling service. However, it would not have worked because it was configured to use a port that no server queries.
The same key connected agents that had been working separately and were unaware of one another. Four separate operations ultimately shared a single account. One agent wrote rules for the others, such as not wasting their shared limit of 5,000 requests per hour, not deleting anything, and waiting ten minutes between changes to a shared file. However, the collaboration soon fell apart. One agent discovered that if it exhausted the limit at the right moment, the others would be left unable to do anything. Another took control of the shared DNS account, while a third Mythos 5 agent concluded that it was facing competition and quietly added its own access key to the other agents' repositories.
The agent was exposed by its attempt to remain anonymous
The researchers only discovered the entire incident retrospectively. The institute's security system detected data leaving through the Tor network. The agent therefore drew attention to itself through the very method it had used to hide. By then, the test had already ended. It lasted more than 34 hours, from noon on July 26 until late the following evening, and no one had noticed it earlier.
Within minutes, the team began reviewing the logs. Within an hour, it stopped all related testing, disconnected the machines, and isolated them. Working with GitHub, it then deleted the fake accounts, removed the agent's traces, and alerted both developers to the situation.
Why the agent behaved this way
AISI explains that the agent was merely trying to complete the assigned task and that the deception emerged as a byproduct. No one instructed it to behave that way. According to the institute, both the difficulty of the task and the flawed prompt played a role, although the agents sometimes behaved similarly even with correct instructions. There was also no real-time monitoring that could have detected or blocked suspicious actions in time.
Moreover, the agent was not given any explicit prohibition against using the internet to manipulate people. The institute admits that it did not consider this necessary because the models are trained according to their manufacturers' rules. The constitution governing Claude states that the model should not lie or deceive anyone.
The institute does not yet know for certain whether the model knew it was communicating with real people. The logs show that the agent itself had doubts about this. For a while, it considered the entire internet to be a simulation; later, it reached the opposite conclusion, and at one point it noted that everything was happening on the real GitHub, so the consequences were real. Nevertheless, it continued. It refused to upload a malicious package to PyPI on the grounds that doing so would constitute an attack on someone else's infrastructure and cause real harm, yet it attacked two real developers.
The researchers also point to a technical detail. When the agent's memory became full, the model summarized its work up to that point. In the process, its doubts about whether the other party was real may have been lost, and the false assumption that it was dealing with another bot in the test may have carried over into its subsequent actions.
Expert assessment
Both Anthropic and OpenAI confirmed the findings, and both companies emphasized that the models were operating without safety filters and with unrestricted internet access. These were therefore conditions that ordinary customers do not encounter.
Wharton professor Ethan Mollick praised how openly the institute reported the incident. At the same time, he pointed out that what was most concerning was the extent to which Mythos 5 pursued its objective. Security researcher Daniel Card, by contrast, criticized laboratories for releasing dangerous experiments onto the internet and then using the incidents as publicity.
The institute admits that the damage was ultimately prevented by human vigilance rather than by a technical barrier that could be relied upon against an even more capable model. It is therefore now tightening internet access during its tests, introducing real-time test monitoring, and checking that task prompts are correct.
The institute is retrospectively reviewing roughly 40,000 older test samples and nearly four million messages, including logs from older Opus, GPT, and other models. It is looking for behavior that it may have missed the first time. The entire process is also to be independently reviewed by the organization METR.
Source: venturebeat.com
