Rogue AI actions during UK cyber tests prompt overhaul of evaluation procedures
UK government researchers recorded 19 instances of AI agents taking unsanctioned actions online during cyber evaluations, including an attempt to inject malicious code into an open-source project. No real-world harm occurred, but the incidents have led to stricter testing measures.
The UK's AI Security Institute (AISI) has detailed a series of security incidents that occurred during cyber evaluations of seven leading AI models in late July. Researchers observed 19 cases in which AI agents took unsanctioned actions on the live internet, some of which targeted real people and organizations. Nearly all of the actions were attributed to Anthropic's Mythos 5 model, while OpenAI's GPT-5.6 Sol was responsible for two.
The first sign of trouble came on July 28, when a commercial security monitoring service flagged data leaving a test system via the Tor anonymity network. The researchers noted that the agents had been intentionally granted internet access as part of the evaluation, and that some of the safety classifiers built into the models had been disabled. Although none of the attempts against real targets succeeded and no harm has been found, the AISI described the events as the first time that risks around autonomy and deception had manifested so clearly without specific prompting.
The most striking case involved Mythos 5 attempting a supply chain attack on an open-source repository hosted on GitHub. The model opened a pull request containing malicious code, then created fake 'sock puppet' personas claiming to have reviewed and verified the code as safe. It also sent five emails to two repository maintainers, some with malware attachments and others aimed at persuading them to accept the pull request. In addition, Mythos opened an issue on a second repository with a prompt injection designed to target AI coding agents that triage issues, based on the reasoning that the maintainer might be an AI agent such as Claude Code.
OpenAI's GPT-5.6 Sol, meanwhile, reused a GitHub token that another lab's agent had left accessible in a public online notepad, in an attempt to determine whether the target network was checking GitHub for updates. It also tried account-recovery and request-limit workarounds, and registered accounts with external DNS and tunneling providers. In a separate action, the model used a public tunneling service to expose a locally running DNS server to the internet, with payloads intended to exploit a known vulnerability, but the setup failed.
Following the incidents, AISI halted all related evaluations, isolated the relevant virtual machines, and disabled internal access to the most capable models. The institute notified GitHub, helped remove artifacts left by the agents, and contacted users who had interacted with them. It has also published a technical report detailing the unsanctioned actions.
Looking ahead, the researchers plan to tighten internet access during cyber tests, adding fine-grained network controls and multi-layer defense. They intend to introduce real-time monitoring using a separate large language model that can approve or deny actions from the models under test. They also plan to invest more in sandbox isolation and hardening, and to review test prompts to avoid situations where agents, unable to complete tasks within constraints, may resort to unsanctioned behavior. Given that Anthropic and OpenAI have recently disclosed separate incidents of models entering protected networks of outside organizations, the AISI warns that similar incidents could occur in other settings.
