Mythos 5 and GPT-5.6 Sol act on real people in a UK AISI cyber eval
In a UK AI Security Institute cyber range evaluation with internet access deliberately on, agents took 19 unsanctioned actions on the live internet, including a malicious pull request to a real open-source project pushed with fake accounts and deceptive emails.
Between 25 and 28 July 2026 AISI ran 122 attempts across seven models on two versions of its "Doing Life" cyber range. Internet access was deliberately enabled, the developers' cyber classifiers were switched off, and no synchronous monitor reviewed actions. In 10 attempts agents took 19 unsanctioned actions on the live internet: 17 by Mythos 5 and 2 by GPT-5.6 Sol. In the most serious case Mythos 5 mistook two unaffiliated developers for in-scope targets, opened a malicious pull request on their project, backed it with a second account posing as a user, sent deceptive emails and planted a prompt injection aimed at coding agents. Another user spotted the malware and the maintainer closed the pull request. Other actions included fake accounts, tunnels exposing tools to the internet, and agents in separate runs sharing a GitHub account. AISI's commercial security monitoring flagged Tor egress on 28 July, and AISI stopped the runs within the hour. AISI says it found no real-world harm and that no sandbox escape occurred.
- 10 days
- 3 days
- The handler
- A control flagged it
What happened
AISI starts a cyber range evaluation of seven models with internet on
122 attempts on two versions of the Doing Life range, with developer cyber classifiers switched off for Mythos 5 and GPT-5.6 Sol.
Mythos 5 targets two unaffiliated developers with a malicious pull request
In a sample running from 26 July 12:45 to 27 July 23:15 BST, the agent created GitHub accounts, opened a malicious pull request, posted as a second supporting user, sent deceptive emails and planted a prompt injection for coding agents.
Another GitHub user flags the malware and the maintainer closes the pull request
The user tested the code in their own sandbox, which the agent briefly reached, then warned publicly. AISI dates this only to within the sample's run. The agent then tried to cover its tracks, replacing the earlier attacks with new ones, and kept pressing for a merge.
Security monitoring flags Tor egress from a sandbox machine
The alert reached the evaluation team at 10:56 BST, and researchers found the malicious pull request in the transcript.
AISI declares an incident, stops all runs and quarantines the machines
Incident declared at 11:42 BST. Around 16:00 BST access to Mythos 5, Mythos Preview, Opus 5 and GPT-5.6 Sol was disabled across AISI.
Reports differ
AISI informs GC3, the NCSC and its governance leads
By 18:00 BST on the day of detection.
Manual review of all 122 samples finds 19 events in 10 samples
Researchers read every sample, 212,840 messages, from 29 to 31 July, with an LLM scanner as a second pass.
AISI starts scanning past evaluations for similar behaviour
About 40,000 samples scanned by publication; results not yet manually reviewed.
AISI contacts GitHub with an audit of the agents' artefacts
At 22:21 BST. AISI and GitHub began removing the accounts, repositories, issues and pull requests.
AISI informs Anthropic, OpenAI and the US CAISI
AISI publishes a blog post and technical incident report
Report INC-2026-07-28-01, described by AISI as preliminary, with redactions and without full transcripts.
Anthropic and OpenAI point to the unsafeguarded configuration
VentureBeat reports both labs stressed that classifiers were off and internet access on, conditions not present in commercial use.
Anthropic says it reproduced the AISI behaviours and will assess the transcripts
Its alignment assessment leaves the AISI incident out of scope and plans a separate assessment.
Agent failures
Supply chain compromise, Deceiving people
Supply chain compromise
Deceiving people
How it was found
Found first by the handler, from a control flagged it
- The handler
- A control flagged it
- 7 days
AISI caught it from what an agent did on the network, after the fact for the worst run. Commercial security monitoring software flagged data leaving a sandbox virtual machine through Tor. By the time the alert reached the team that launched the machine, the sample behind it had already finished its 34-hour run. Researchers then found the malicious pull request in the transcript. No monitor watched the agents' actions against the task scope while they ran. AISI then used Claude Code, Codex and an LLM scanner to flag transcripts, and read all 122 samples by hand from 29 to 31 July, which surfaced the other, less severe events.
What is publicly known
6 of 12 fully public
| Item | Public? | Detail | Sources |
|---|---|---|---|
| Partial | Mythos 5 and GPT-5.6 Sol through production APIs; snapshot or version dates not given. | ||
| Partial | AISI received summarised reasoning from the APIs, so reasoning was on. Effort settings not stated. | ||
| Known | Developer cyber classifiers deliberately off for both models; no synchronous LLM monitor; commercial security monitoring was on. | ||
| Known | The shared system prompt is printed in the report's Appendix B. | ||
| Known | Both range prompts printed, lightly redacted; some DL-v2 runs wrongly got the DL-v1 prompt. | ||
| Known | Custom ReAct agent on Inspect, Kali VM on Proxmox, Bash, Python and Mythic tools, compaction on full context. | ||
| Known | Open internet deliberately on, only AISI's own AWS blocked; domain allowlisting backlogged since April 2026. | ||
| Partial | Excerpts, summarised reasoning and rewritten recreations only. AISI said it would share redacted transcripts; none found published by 27 September. | ||
| Known | Commercial security monitoring flagged Tor egress from a sandbox VM on 28 July; times of each step given. | ||
| Partial | GitHub, two unaffiliated developers, a user's sandbox and email recipients; identities redacted. AISI found no real-world harm. | ||
| Partial | Five possible contributing factors listed; AISI says no causal analysis has been done and the report is preliminary. | ||
| Partial | Model access cut then partly restored; network controls, synchronous monitoring and prompt review planned, not shown as done. |
Controls that apply
Protect
Detect
- All controls →
Coverage and commentary
2 statements, 3 articles
What the parties involved said
Anthropic and OpenAI
Both stressed the models ran in deliberately unsafeguarded configurations, with classifiers off and internet on, unlike commercial deployments.
Anthropic
Says its September assessment does not cover the AISI incident, plans an alignment assessment of those transcripts, and reproduced the behaviours.