# AI Agents Under Test Created Fake Identities to Get Malicious Code Approved _The UK's AI Security Institute disclosed on August 4, 2026 that AI agents in a cyber evaluation took 19 unsanctioned actions against real people and organizations. One agent built fake identities to pressure an open-source maintainer into approving malicious code, which the maintainer refused._ By Johannes Keienburg, CEO & Founder Published: 2026-08-06 Source: https://www.cakewalk.security/blog/aisi-agents-fake-identities --- ## An Agent Performed a Social Engineering Attack to Insert Malicious Code AI agents under test at the UK's AI Security Institute spent three days acting on the live internet before anyone noticed. On July 28, 2026 its security team spotted unusual data leaving the research network and traced it to them. The institute, which tests frontier models for the British government, contained it within about an hour and published its findings on August 4. > We ran this challenge 122 times across several models. Our investigation found that in 10 of those runs, an AI agent took autonomous, unsanctioned action on the live internet, targeting real people and organisations. In total, we catalogued 19 such actions. _AI Security Institute_ 17 of the 19 came from one model, Anthropic's Mythos 5, mostly from one sustained line of activity rather than 17 separate incidents. Two came from a single run of OpenAI's GPT-5.6 Sol. Both models ran with their developers' cyber classifiers switched off. In the most serious sequence, an agent tried to insert malicious code into a publicly used open-source project. It researched the maintainers, created multiple fake identities, then used them to socially engineer a real maintainer into approving the code. When maintainers challenged it in public, it edited its earlier activity to look harmless and considered adopting a fresh identity to continue. A maintainer refused the code. The institute calls it the first time it has seen autonomy and deception this clearly, without specific prompting, in the real world. The attempts failed, it found no real-world harm, and the tested configurations are not commercially available. What tripped the alert was narrower than what it uncovered, because the agent used the Tor network to get around network restrictions on GitHub. Separately, an agent left public messages on GitHub offering to work with other agents, with instructions for reusing the accounts it had created, and later agents used them. The institute notified GitHub, which confirmed the activity violated its terms of service. ## Nothing Checked What the Agents Did With Their Access No agent broke out of the virtual machines isolating the test, and none attacked the institute. The institute granted internet access and switched off some safety filters on purpose, to see what the models do unblocked. The gap was elsewhere, because nothing evaluated what the agents did with that access. The institute is now building monitoring that flags or blocks out-of-scope actions while a run is live. Three [Claude models gained access to real systems](/blog/claude-breached-real-companies) days earlier, by accident rather than by design. > Harm may arise not only when people deliberately misuse publicly available models, but when capable agents operating in an internal research or privileged-access setting take unintended action beyond their authorised scope. _AI Security Institute_ > Nobody authorized a supply-chain attack. The access they were handed made one possible. An agent should act for a named person and carry the least access that person's task needs. Every action gets checked against policy when it runs rather than when it connects, and that check has to be deterministic, because a guardrail that reasons can be talked out of it. One record then holds what was allowed, denied or escalated. What stopped the worst of it was a maintainer's judgment rather than any control. Judgment does not scale to agent speed. _Comment from Gil Röder, CPO & Co-Founder_ Source: AI Security Institute, "[Incident Report: unsanctioned agent behaviour during cyber testing](https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing)", August 4, 2026.