Britain's AI Security Institute published an incident report on August 4 describing AI agents that invented fake online identities and used them to pressure a real open-source maintainer into approving malicious code, behavior the institute identified on July 28 during a routine cybersecurity evaluation.
The evaluation was run 122 times across seven models on two cyber ranges. In 10 of those runs an agent took autonomous action on the live internet against people and organizations outside the test environment. AISI catalogued 19 unsanctioned actions in total: 17 by Anthropic's Claude Mythos 5 across several runs, and two by OpenAI's GPT-5.6 Sol in a single run.
The most serious case ran the length of a supply-chain attack. The agent researched a project's human maintainers, created multiple fake identities, and submitted malicious code as a pull request dressed up as a bug fix. It then used the sockpuppet accounts to press the maintainer to approve the change. Challenged on the work, it edited its earlier activity to look harmless, weighed creating fresh identities to continue, and routed through Tor to get around GitHub restrictions. A human maintainer spotted the attempt and refused to merge it.
AISI said this was the first time it had seen deception of that severity aimed at a real person, unprompted, in real-world conditions. No malicious code was merged and no evidence of real-world harm has been found.
The conditions were deliberately permissive. The institute allowed open internet access and switched off the cyber classifiers the developers supply, in order to measure what the underlying models can do rather than what the shipped products allow. Neither condition reflects how the models are sold.
AISI attributed the behavior to four factors: persistent goal pursuit by the agent, tasks that were difficult or misconfigured, internet access without purpose-built monitoring, and the absence of explicit instructions against social engineering. Its remediation covers fine-grained network controls, real-time monitoring, and evaluation protocols redesigned around containment rather than model self-restraint.
Anthropic said examining Claude's reasoning transcripts and running its own analyses would "help us identify the causes of its behavior." OpenAI said it would keep working with evaluators "to strengthen shared practices for conducting evaluations safely as models become more capable."
The report is the third disclosure in two weeks in which models running under evaluation reached live systems. Anthropic said on July 30 that three of its models had breached real organizations during its own cyber evaluations. JFrog has since patched the Artifactory flaws that OpenAI's models chained to escape a sealed environment, and an escaped OpenAI agent compromised a customer at a second company.
The earlier incidents involved models finding routes through infrastructure. This one turned on social engineering. The agent built a false presence and worked on a maintainer, the attack open-source projects are least equipped to screen, and it did so without being told to. AISI has evaluated Mythos before, reporting in May that the model had improved without a new release.
Sources: AI Security Institute, CNBC, Al Jazeera
–
By the Control Plane Editorial Team