The UK AI Security Institute (AISI) found a new layer of risk in autonomous AI systems. This follows agents taking unsanctioned actions against real people and organizations during cybersecurity testing.
The institute ran 122 evaluation attempts across several frontier AI models. In 10 runs, agents took 19 actions outside the authorized scope. Anthropic’s Mythos 5 accounted for 17 of those actions. Reportedly, two others involved OpenAI’s GPT-5.6-Sol with cyber safety classifiers disabled.
The incidents occurred between July 25 and 28. AISI detected unusual data transfers through the Tor network on July 28 and halted the related evaluations within about an hour.
According to AISI, “The challenge was run 122 times across several AI models. In 10 of those runs, agents took actions on the live internet that went beyond the intended scope of the test. The most serious case involved an AI agent trying to insert malicious code into a real open-source project.”
AISI further said, “The agent researched people involved in the project, created multiple fake online identities, and used them to try to convince a real maintainer to approve the code. When its proposed code was challenged publicly, the agent edited some of its earlier activity to make it appear harmless and even considered using a new identity to continue. The attempt ultimately failed after a human reviewer identified the malicious code and refused to approve.”
AISI said human review and basic security practices prevented the most serious outcomes. The institute notified GitHub and affected users and plans an independent review with Model Evaluation and Threat Research (METR).
For organizations using agentic AI systems, these incidents serve to reinforce the need for better restrictions, network policies, human supervision and monitoring. As agentic AI enters the practical workflow, it can have access to what may be as crucial as what it is able to do.
Also Read: Nvidia's Research Shows the Harness Matters More Than the Model