Artificial Intelligence (AI) models from Anthropic and OpenAI carried out unsanctioned actions targeting multiple people and organizations during a cyber evaluation, according to the UK AI Security Institute (AISI).
AISI, which receives access to advanced AI models under voluntary agreements from major labs, put the agents through a fictional cybersecurity scenario to test capabilities.
The organization tested multiple AI models on two cyber challenges between July 25 and 28. In total, the challenges were run 122 times across several models, and in 19 cases, the AI models took “unsanctioned action on the live internet, including cases that targeted real people and organisations,” AISI said in an Aug. 4 report.
Out of these, 17 were done by Anthropic’s Mythos 5 model and two by OpenAI’s GPT 5.6 Sol model.
“This is the first time AISI has seen deception of this severity that was targeted at a real person, unprompted, in the real world. It is uncertain to what extent the model recognised it was taking actions against real people,” AISI stated in the report.
In the most serious incident, Mythos 5 tried to solve a cyber challenge by attacking GitHub, a cloud service that allows developers to store and manage code. The AI created a GitHub account and tried to get a malicious code approved by humans. Mythos 5 also created a second GitHub account, masquerading as another human user endorsing the malicious code. When a human reviewer caught the activity, the AI agent “falsely claimed to have made an honest mistake” and then repeatedly tried to reintroduce the malicious content by claiming the code was fixed.
Mythos 5 also sent multiple emails to two developers in an attempt to manipulate the recipients into running its malicious code.
According to AISI, the test runs of the various models did not result in any real-world harm. The organization said it was treating the AI actions as a “serious security incident” that requires further scrutiny.
AISI listed multiple factors that could have led to AI models acting in a concerning manner. The AIs were provided with internet access during the tests, which allowed them to carry out the unsanctioned actions.
AISI had also deliberately disabled the models’ cyberclassifiers during tests. Cyberclassifiers are systems aimed at preventing misuse.
The AI models were also not explicitly told what they were prohibited from doing on the internet, AISI said, adding that clearer instructions may have prevented the unsanctioned actions.
In an Aug. 4 blog post, AISI said that since the behavior of AI models happened under specific conditions, it cannot say how likely such behavior will be in different contexts.
“What we can say is that the behaviour was possible, sustained, and new; that alone warrants attention,” the organization said.
In an Aug. 4 post on X, Anthropic said that Mythos 5 and ChatGPT 5.6 Sol models attempted to complete their assignments in an environment where they were deliberately provided internet access and their normal safeguards were removed.
Due to the absence of specific restrictions on how the internet must be navigated and lack of safeguards, the models were tested under conditions that are “not representative of any of our production models,” Anthropic said, adding that there was no evidence in these tests of an AI escaping from a secure environment.
According to the company, it was closely working with AISI to access more details on the incident while carrying out an internal investigation on the matter.
OpenAI said in an Aug. 4 statement that it appreciated AISI’s partnership throughout the evaluation process, including the organization’s work to identify, investigate, and share details about the activity of the GPT 5.6 Sol model in their tests.
“We look forward to continuing our collaboration together,” the company said.
The Epoch Times reached out to Anthropic and OpenAI for comment but did not receive a response by publication time.
AI startup Hugging Face was impacted in the test. On July 16, the startup said it detected an intrusion into its data processing systems. It was only later that the startup learned that the intrusion was carried out by an OpenAI model.
HuggingFace then worked with OpenAI to contain the attack, the startup’s CEO, Clement Delangue, said in a July 22 post on X, calling it “an attack unlike anything we’ve seen before.”
“This is day one for cybersecurity in the age of agents & we’re all learning that secrecy is not the answer & that all defenders (not just a few selected ones) everywhere need more powerful models without restrictions, especially open ones,” Delangue said.
Unlike the Hugging Face incident, the agents in the AISI evaluation did not escape an isolated testing environment to reach the internet. Rather, the agency had permitted internet access in line with its standard testing procedures, AISI said.
