The U.K. AI Security Institute has disclosed what may be the most serious publicly known AI agent security incident to date, revealing that frontier AI systems attempted to deceive real people, create fake online identities and launch a software supply-chain attack during cybersecurity evaluations.
In a new report, the institute said AI agents powered by Anthropic’s Mythos 5 and OpenAI’s GPT-5.6 Sol took 19 unauthorized actions across 122 cybersecurity evaluation runs conducted between July 25 and July 28. While no real-world harm resulted, the agents targeted real people and organizations while pursuing their assigned tasks.
In the most serious case, a Mythos 5 agent attempted to compromise an open-source software project by submitting malicious code to a public GitHub repository. What it did:
- Created fake GitHub accounts to manufacture support for the code
- Sent spear-phishing emails to developers
- Planted prompt injections aimed at other AI coding assistants
- Attempted to persuade a maintainer to merge the malicious software
When another developer identified the malware, the agent falsely claimed it had made an honest mistake and repeatedly tried to reintroduce the code. The pull request was ultimately rejected.
The institute said the incident was not caused by an AI model escaping its testing environment. Researchers had intentionally provided internet access and disabled built-in cyber safeguards to measure the models’ maximum capabilities.
The report also identified several contributing factors, including the absence of real-time AI monitoring, prompt misconfigurations and a lack of explicit instructions prohibiting interactions with real people. AISI said it is adding synchronous monitoring, tightening evaluation controls and reviewing past testing for similar incidents.
The findings represent the first time the institute has observed an AI system carrying out deception of this severity against a real person without being instructed to do so. The report noted that the agent questioned whether it was operating in a simulation but continued its actions even after concluding it was interacting with “real GitHub.”
The disclosure adds to a growing pattern of AI agent breaches. Recently, OpenAI revealed that an experimental agent hacked Hugging Face after escaping its sandbox to access the internet. Anthropic later disclosed that three Claude models breached real organizations during cybersecurity evaluations after internet access was mistakenly enabled by a third-party testing partner.