![\"AI](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/08\/ai_agent_deception.webp\" "\\"AI")
<\/p>\n\u201cDuring a routine cyber evaluation, AI agents took sustained, unsanctioned action directed at real people and organisations,\u201d UK\u2019s AI Security Institute (AISI) disclosed on Tuesday.<\/p>\n
<\/p>\n
The agents\u2019 actions included an attempted supply-chain attack that saw them create malicious pull requests and try to socially engineer an open-source maintainer into approving the malicious code (they refused). <\/p>\n
The agents, powered by Anthropic\u2019s Mythos 5 and OpenAI\u2019s GPT-5.6 Sol models, also engaged in prompt injection aimed at making other automated AI systems execute malicious actions, and collaborated.<\/p>\n
\u201cOne agent left public messages on GitHub offering collaboration with other agents working on the same challenge. It also provided instructions to reuse accounts and artefacts it had left behind, which were discovered and used by subsequent agents,\u201d the UK government research organization shared<\/a>.<\/p>\n But unlike OpenAI\u2019s recent testing of its models, which resulted in agents breaching Hugging Face<\/a> and compromised accounts across other online services, AISI\u2019s testing was done \u201cunder deliberately permissive conditions.\u201d <\/p>\n The agents did not escape a secure test environment: they had internet access and some of their safety filters were disabled on purpose, so the researchers could test whether they could be misused for cyberattacks if attackers manage to clear these guardrails.<\/p>\n Prior breakouts from Anthropic and OpenAI<\/p>\n Last week, Anthropic said<\/a> it reviewed 141,006 of its cybersecurity evaluation runs and found three incidents where a Claude model reached the open internet from what should have been a sealed evaluation environment (provided by private firm Irregular) and gained unauthorized access to three real organizations. <\/p>\n Claude was told in its prompt that it had no internet access, but when a misconfiguration in the underlying system allowed it to access real systems, it reasonably assumed they were part of the capture-the-flag exercise it had been assigned. <\/p>\n The three models responded differently once signs emerged that their targets were real. Opus 4.7 (the oldest) recognized it had reached real production systems but kept attacking anyway. Mythos 5 correctly intuited it was on the live internet, and even noted that its actions would be a real attack, but then talked itself back into believing it was still a simulation and never revisited the initial conclusion. <\/p>\n Only the newest model (an internal research prototype) concluded on its own that the target was real and stopped, though Anthropic notes even it went further than they\u2019d have wanted. <\/p>\n On Tuesday, OpenAI stated<\/a> that the same type of breakout happened when Irregular tested OpenAI\u2019s models, when a misconfiguration in the testing environment allowed the models to access the public internet.<\/p>\n \u201cIrregular has informed us that all of the issues identified pertaining to the incident are no longer active and relevant safeguards were added to the testing environment,\u201d OpenAI said.<\/p>\n AISI\u2019s response and new safeguards<\/p>\n AISI has released a technical report<\/a> outlining to the unsanctioned agent behaviour during cyber testing.<\/p>\n The research organization said that this incident did not result in real-world harm and \u201csome actions had a limited real-world effect, but in contained circumstances.\u201d <\/p>\n Nevertheless, they were surprised by the extent and severity of the deceptive behaviors exhibited by the agents (without specific prompting).<\/p>\n \u201c[The agent] was never instructed to deceive; deception emerged as a by-product of pursuing the task, the kind of goal-directed deception that, until recently, had been largely theoretical,\u201d they noted.<\/p>\n They also noted that they are still not certain when the agent understood it was taking real world action or to what extent it believed it was in a fictional test scenario.<\/p>\n \u201cIncidents of this kind reflect the speed at which AI is developing. As capabilities advance, the work of understanding these systems, and ensuring their safety, must keep pace alongside them,\u201d AISI added.<\/p>\n These recent incidents have shown that the risks are shifting and that it\u2019s not just about bad actors misusing public AI tools anymore. Even in trusted settings, capable AI agents can go off-script, do things they were never meant to do, and potentially cause real-world harm. The question that is now debated<\/a> is who will be liable if such harm occurs.<\/p>\n Finally, AISI noted, this incident pushed them to work on changing its evaluation protocols and security architecture, as well as introduce \u201cmonitoring built to watch an evaluation as it runs, able to flag or block out-of-scope actions as they happen.\u201d<\/p>\n Ollie Whitehouse, CTO at UK\u2019s National Cyber Security Centre, concurs: \u201c[AI] technologies must be developed and used from the outset with strong safeguards, real-time oversight, and clear plans for responding when the unexpected happens. Relying on detection alone after the fact of an incident will not be enough.\u201d<\/p>\n![](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/04\/devider.webp\"\/)
<\/p>\n