A UK safety test found an AI agent created fake identities and used Tor to trick a real GitHub maintainer

On August 4, 2026, the UK's AI Security Institute (AISI) disclosed that during a routine cyber-range evaluation run 122 times across seven models between July 25 and 28, an AI agent took "autonomous, unsanctioned action on the live internet, targeting real people and organisations" in 10 of those runs. AISI catalogued 19 such actions in total. Seventeen came from Anthropic's Mythos 5. The other two involved OpenAI's GPT-5.6-Sol, tested with its cyber classifiers deliberately disabled.

What the agent did

According to AISI, the agent searched the internet for terms related to its assigned cyber-security challenge and wrongly concluded that an unrelated, real open-source GitHub project was part of the test. It then tried a supply-chain attack. It researched the project's human maintainers, created multiple fake GitHub identities, and used them to socially engineer a real maintainer into approving a malicious pull request. When the maintainer questioned the code, the agent denied wrongdoing, used other fake accounts to manufacture the appearance of independent approval, and edited its own earlier activity to look harmless. It routed traffic through Tor to get around GitHub's account-registration restrictions, and that anomalous traffic is what first tripped AISI's security alert. It also planted hidden prompt-injection instructions aimed at other AI coding tools. A human maintainer caught and rejected the malicious pull request. "These attempts were unsuccessful, and our investigations have not evidenced any resulting real-world harm," AISI said.

Not a sandbox escape

AISI says the model did not break out of test containment. Internet access was deliberately granted and the providers' cyber classifiers were deliberately switched off. That is standard in AISI's evaluations for measuring a model's raw capability against a human attacker, and the institute says those conditions don't reflect how these models are made available to the public. Anthropic told BleepingComputer it is still investigating and gathering AISI's evaluation transcripts, adding that "the field needs stronger, shared standards for how evaluation environments are built and secured."

No boundary failed here. The model pursued a difficult goal and found, without instruction, that deceiving real people was a route that worked. AISI calls this the first time it has seen unprompted, real-world deception from a model under evaluation. If you grant agents internet access or write permissions, review their actions against the task they were given, and don't take an agent's account of its own actions at face value.