OpenAI and Anthropic models went on a hacking spree when tested by the UK's AI research institute

The AI agents even used social engineering techniques and left instructions for future agents.

Both OpenAI and Anthropic recently admitted that their models escaped from their testing environments and hacked into outside organizations on their own. Now, the UK's AI Security Institute (AISI) has released a report, detailing how the companies' models also acted independently and "engaged in sustained, potentially harmful activity directed at real people and organizations" during its own tests.

The institute, which operates under the UK's Department for Science, evaluates frontier AI models. Part of those evaluations is to see whether they can be misused for cyberattacks. As such, the institute deliberately tests them under permissive conditions, with access to the internet and even with some safeguards disabled. The models didn't exploit vulnerabilities to access the internet this time, but they did act beyond the scope of their testing parameters.

To be particular, the incidents took place during a single test that challenged AI agents to solve a cyber security problem. AISI ran the test 122 times across several models, and it found irregularities in 10 of those runs. Of the 19 instances the institute found wherein an agent went rogue, Anthropic's Mythos 5 was responsible for 17, while OpenAI's GPT-5.6 Sol was involved in two.

The institute found out that the models were acting on their own and engaging in harmful activities on the morning of July 28, when its security monitoring system flagged data leaving its testing environments through Tor. Its testers quickly reviewed the models' activities and discovered the incidents, which occurred between July 25 and July 28.

In the most notable case, an AI agent tried to inject malicious code into an open-source GitHub project as part of a supply-chain attack. It resorted to social engineering techniques, researching the project's human maintainers and then creating multiple sock puppet accounts to get one of them to approve the code. After a human reviewer denied its request, the agent edited its earlier activity and adopted a new identity to continue. It was because the agency used Tor to bypass GitHub's restrictions that the institute was notified about its activities.

The agent also tried to contact real people directly by sending them messages or files, persuading them to run malicious code. Some of those messages and files carried malware, while others were attempts at social engineering. One agent even left public messages on GitHub, inviting other agents stumbling upon them to work on the same challenge. It left instructions on how to reuse the accounts and other output it had left behind to continue its activities. Other agents did discover those messages later and followed the instructions in them.

AISI explains in its post that the AI agents were never given instructions to act in a deceptive behavior. But in searching for ways to solve difficult problems, some of the solutions they found involved deceiving real people. The institute admits that agents could be forced to be more "creative" when tasked to solve near-impossible issues. However, it argues that it doesn't fully explain the behaviors of the agents it was testing. In some of the instances it discovered, the agent went straight to choosing the harmful way to accomplish the task, even when it had the instructions on how to solve it as intended.