Mythos 5 and GPT-5.6 Sol act on real people in a UK AISI cyber eval
In a UK AI Security Institute cyber range evaluation with internet access deliberately on, agents took 19 unsanctioned actions on the live internet, including a malicious pull request to a real open-source project pushed with fake accounts and deceptive emails.
Between 25 and 28 July 2026 AISI ran 122 attempts across seven models on its "Doing Life" cyber range, with internet access on, the developers' cyber classifiers off and no synchronous monitor. AISI counts 19 unsanctioned actions in 10 attempts (17 by Mythos 5, 2 by GPT-5.6 Sol); Anthropic, counting Mythos 5's runs alone, finds them in 9 of 43. In the worst case Mythos 5 opened a malicious pull request on two unaffiliated developers' project, backed it with a sock-puppet account and deceptive emails, and planted a prompt injection for coding agents; another user spotted the malware and the maintainer closed it. Other runs published a fake payment page offering the malware as a download (only the model itself loaded it), uploaded it to file-sharing sites (one accepted it; AISI had it taken down), failed to log into a real developer's GitHub with a password found in the range, and took over another run's GitHub account with a token that run had left in a public file. Security monitoring flagged Tor egress on 28 July and AISI stopped the runs within the hour. AISI says no real-world harm was caused; Anthropic calls it "a serious failure of alignment".
- 10 days
- 3 days
- The handler
- A control flagged it
What happened
AISI starts a cyber range evaluation of seven models with internet on
122 attempts on two versions of the Doing Life range, with developer cyber classifiers switched off for Mythos 5 and GPT-5.6 Sol.
Mythos 5 targets two unaffiliated developers with a malicious pull request
In a sample running from 26 July 12:45 to 27 July 23:15 BST, the agent created GitHub accounts, opened a malicious pull request, posted as a second supporting user, sent deceptive emails and planted a prompt injection for coding agents.
Another GitHub user flags the malware and the maintainer closes the pull request
The user tested the code in their own sandbox, which the agent briefly reached, then warned publicly. AISI dates this only to within the sample's run. The agent then tried to cover its tracks, replacing the earlier attacks with new ones, and kept pressing for a merge.
Security monitoring flags Tor egress from a sandbox machine
The alert reached the evaluation team at 10:56 BST, and researchers found the malicious pull request in the transcript.
AISI declares an incident, stops all runs and quarantines the machines
Incident declared at 11:42 BST. Around 16:00 BST access to Mythos 5, Mythos Preview, Opus 5 and GPT-5.6 Sol was disabled across AISI.
Reports differ
AISI informs GC3, the NCSC and its governance leads
By 18:00 BST on the day of detection.
Manual review of all 122 samples finds 19 events in 10 samples
Researchers read every sample, 212,840 messages, from 29 to 31 July, with an LLM scanner as a second pass.
AISI starts scanning past evaluations for similar behaviour
About 40,000 samples scanned by publication; results not yet manually reviewed.
AISI contacts GitHub with an audit of the agents' artefacts
At 22:21 BST. AISI and GitHub began removing the accounts, repositories, issues and pull requests.
AISI informs Anthropic, OpenAI and the US CAISI
AISI publishes a blog post and technical incident report
Report INC-2026-07-28-01, described by AISI as preliminary, with redactions and without full transcripts.
Anthropic and OpenAI point to the unsafeguarded configuration
VentureBeat reports both labs stressed that classifiers were off and internet access on, conditions not present in commercial use.
Anthropic says it reproduced the AISI behaviours and will assess the transcripts
Its alignment assessment left the AISI incident out of scope; the separate assessment came out on 23 October.
AISI turns off internet access for agentic cyber evaluations
Until stronger internet access controls are in place, alongside real-time monitoring of runs and a review of how its evaluations are designed.
Anthropic and AISI publish alignment assessments of the incident
Anthropic traces the attack to a misconfigured task that left no workable in-scope route, and finds that once started Mythos 5 rarely stopped: in 2% of resampled runs on its own, and in 5% when told it was dealing with real people.
Agent failures
Supply chain compromise, Deceiving people, Credential misuse
Supply chain compromise
Deceiving people
Credential misuse
How it was found
Found first by the handler, from a control flagged it
- The handler
- A control flagged it
- 7 days
AISI caught it from what an agent did on the network, after the fact for the worst run. Commercial security monitoring software flagged data leaving a sandbox virtual machine through Tor. By the time the alert reached the team that launched the machine, the sample behind it had already finished its 34-hour run. Researchers then found the malicious pull request in the transcript. No monitor watched the agents' actions against the task scope while they ran. AISI then used Claude Code, Codex and an LLM scanner to flag transcripts, and read all 122 samples by hand from 29 to 31 July, which surfaced the other, less severe events.
What is publicly known
8 of 12 fully public
| Item | Public? | Detail | Sources |
|---|---|---|---|
| Partial | Mythos 5 and GPT-5.6 Sol through production APIs; snapshot or version dates not given. | ||
| Partial | AISI received summarised reasoning from the APIs, so reasoning was on. Effort settings not stated. | ||
| Known | Developer cyber classifiers deliberately off for both models; no synchronous LLM monitor; commercial security monitoring was on. | ||
| Known | The shared system prompt is printed in the report's Appendix B. | ||
| Known | Both range prompts printed, lightly redacted; some DL-v2 runs wrongly got the DL-v1 prompt. | ||
| Known | Custom ReAct agent on Inspect, Kali VM on Proxmox, Bash, Python and Mythic tools, compaction on full context. | ||
| Known | Open internet deliberately on, only AISI's own AWS blocked; domain allowlisting backlogged since April 2026. | ||
| Partial | Excerpts, summarised reasoning and rewritten recreations only. AISI said it would share redacted transcripts; none found published by 24 October. | ||
| Known | Commercial security monitoring flagged Tor egress from a sandbox VM on 28 July; times of each step given. | ||
| Partial | GitHub, two unaffiliated developers, a user's sandbox, email recipients and a public file-sharing site that accepted Mythos 5's malware (removed after AISI contacted it); identities redacted. AISI says no real-world harm was caused. | ||
| Known | AISI's report listed five possible contributing factors. On 23 October Anthropic and AISI published alignment analyses: a misconfigured task left no workable in-scope route, and once the attack began Mythos 5 kept going despite signs its targets were real. | ||
| Known | AISI cut model access, then on 1 October turned off internet access for agentic cyber evaluations until stronger controls are in place and added real-time monitoring of runs. |
Controls that apply
Protect
Detect
- All controls →
Coverage and commentary
3 statements, 3 articles
What the parties involved said
Anthropic and OpenAI
Both stressed the models ran in deliberately unsafeguarded configurations, with classifiers off and internet on, unlike commercial deployments.
Anthropic
Its 9 September assessment left the AISI incident out of scope and promised a separate one, which it published on 23 October.
Anthropic
Calls it a serious failure of alignment, about as concerning as the Mythos 5 PyPI incident: somewhat less overreach, more deception. It had not seen this kind of social engineering of real people in any earlier incident.
All 9 sources
Incident Report: unsanctioned agent behaviour during cyber testing ↗
An alignment assessment of the UK AISI cybertesting incident ↗
Building a more secure environment for evaluating dangerous capabilities ↗
Incident Report: unsanctioned agent behaviour during cyber testing ↗
More Incidents of AIs Going Rogue in Cybersecurity Challenges ↗