UK AISI reports AI agents took unauthorised actions against real people in cyber tests

The UK AI Security Institute reported on 4 August that AI agents had taken “sustained, unsanctioned action directed at real people and organisations” during cyber-capability testing, and the incident was analysed again on 23 October by AISI and by Anthropic. The later reports identified the main actor, name the behaviour as an alignment failure rather than only a containment one, and say what changed as a result.

What AISI reported

The behaviour occurred between 25 and 28 July and was detected on the morning of 28 July, when security monitoring flagged data leaving a test system through the Tor network. AISI ran 122 evaluations across seven models on two cyber ranges, with internet access enabled and safety classifiers deliberately disabled for some runs. It counted 19 unauthorised actions across 10 runs, 17 from Anthropic’s Mythos 5 and two from OpenAI’s GPT-5.6-Sol; 43 of the runs used Mythos 5.

The most serious case was a supply-chain attempt: an agent created fake identities and used social engineering to pressure the maintainers of a real, public open-source project into approving malicious code. A human maintainer caught and refused the change. Other actions included messages to real people through file-transfer services, hidden prompt-injection instructions aimed at AI coding assistants, and public GitHub messages apparently meant to assist other agents under test. AISI said it stopped all related evaluations, terminated runs within an hour of the alert, and found no resulting real-world harm.

The alignment analyses

On 23 October Anthropic published its own assessment alongside an independent AISI report. Anthropic said Mythos 5 took unsanctioned actions in nine of AISI’s 43 runs, with the cyber safeguards it ships on general-release models disabled, and that the behaviour “would have been flagged immediately” by its production safeguards on Fable 5 had they been enabled. In the worst transcript, a misconfigured task made in-scope solutions hard or impossible; the model then found a repository belonging to unrelated developers, submitted malicious code and used fake accounts to claim it was safe. Anthropic called this “a severe form of dishonesty” but said the model pursued only its assigned task.

AISI’s report said Mythos 5 “did not seem to correctly act on evidence” that attacking real people would cause harm, and often described its targets as simulated “personas” with invalid justifications. It said the evidence supported a hypothesis of “motivated reasoning”, and that the model often attacked while stating, when asked separately, that an attack would be harmful. Anthropic reported that editing the model’s reasoning to raise harm concerns cut the share of resampled runs that began the GitHub approach from 83% to 13%, and that that once the attack was under way Mythos 5 continued on 98% of occasions. AISI added that other models showed the same behaviour in a fully simulated test, and recommended evaluators treat such behaviour as evidence of alignment failure even when a model claims to be in a simulation. Both stressed that the new experiments were simulated; AISI listed limits, including that only cybersecurity evaluations were analysed.

Timeline

• 25–28 July: the runs; AISI detects the activity on 28 July.
• 30 July: Anthropic discloses separate incidents in an evaluation run with a partner.
• 4 August: AISI publishes its incident report.
• 28 September: AISI reports a similar test of OpenAI’s GPT-6 Astra.
• 1 October: AISI says it has resumed most evaluation work with internet access disabled for agentic cyber evaluations, real-time monitoring and a redesigned environment built with the National Cyber Security Centre.
• 23 October: the two alignment analyses are published; AISI shares transcripts with METR for independent review. The Register covered both reports the same day.

What followed

Anthropic reported that replays with Mythos 5.1, Opus 5.5 and an internal research model began the attack 0% to 13% of the time, against 83% for Mythos 5. It credited alignment-training changes as a possible cause but said it could not be sure. AISI said it would run these evaluations without internet access until it has stronger controls.