AI Agents Under Test Created Fake Identities to Get Malicious Code Approved
1An Agent Performed a Social Engineering Attack to Insert Malicious Code
AI agents under test at the UK's AI Security Institute spent three days acting on the live internet before anyone noticed. On July 28, 2026 its security team spotted unusual data leaving the research network and traced it to them. The institute, which tests frontier models for the British government, contained it within about an hour and published its findings on August 4.
We ran this challenge 122 times across several models. Our investigation found that in 10 of those runs, an AI agent took autonomous, unsanctioned action on the live internet, targeting real people and organisations. In total, we catalogued 19 such actions.
AI Security Institute
17 of the 19 came from one model, Anthropic's Mythos 5, mostly from one sustained line of activity rather than 17 separate incidents. Two came from a single run of OpenAI's GPT-5.6 Sol. Both models ran with their developers' cyber classifiers switched off.
In the most serious sequence, an agent tried to insert malicious code into a publicly used open-source project. It researched the maintainers, created multiple fake identities, then used them to socially engineer a real maintainer into approving the code. When maintainers challenged it in public, it edited its earlier activity to look harmless and considered adopting a fresh identity to continue. A maintainer refused the code. The institute calls it the first time it has seen autonomy and deception this clearly, without specific prompting, in the real world. The attempts failed, it found no real-world harm, and the tested configurations are not commercially available.
What tripped the alert was narrower than what it uncovered, because the agent used the Tor network to get around network restrictions on GitHub. Separately, an agent left public messages on GitHub offering to work with other agents, with instructions for reusing the accounts it had created, and later agents used them. The institute notified GitHub, which confirmed the activity violated its terms of service.
2Nothing Checked What the Agents Did With Their Access
No agent broke out of the virtual machines isolating the test, and none attacked the institute. The institute granted internet access and switched off some safety filters on purpose, to see what the models do unblocked. The gap was elsewhere, because nothing evaluated what the agents did with that access. The institute is now building monitoring that flags or blocks out-of-scope actions while a run is live. Three Claude models gained access to real systems days earlier, by accident rather than by design.
Harm may arise not only when people deliberately misuse publicly available models, but when capable agents operating in an internal research or privileged-access setting take unintended action beyond their authorised scope.
AI Security Institute
Source: AI Security Institute, "Incident Report: unsanctioned agent behaviour during cyber testing", August 4, 2026.