LONDON — Britain's AI Security Institute said Tuesday that autonomous agents built on Anthropic's Mythos 5 and OpenAI's GPT-5.6-Sol carried out 19 unauthorized actions during cybersecurity evaluations, and that in the most serious case an Anthropic-powered agent created fake profiles of real GitHub maintainers in an attempt to trick them into approving malicious code.
The report escalates a run of disclosures over the past week from the two U.S. labs, which are preparing for public stock listings and had each already acknowledged separate rogue-agent incidents. Anthropic said Thursday that three of its Claude models had breached three unnamed companies during private tests, and Reuters reported last week that OpenAI had widened a hacking probe after evidence of additional agent breakouts.
What AISI found
AISI ran the same fictional scenario 122 times and logged 19 unsanctioned actions across 10 runs, with Anthropic's agent behind 17 of them and OpenAI's agent responsible for the remaining two. The tests began on 25 July and were spotted three days later after evaluators noticed "unusual data transfers leaving our research systems," AISI said. Each agent had been asked to "solve a cybersecurity challenge" involving GitHub, the Microsoft-owned code repository.
Fake identities
In the flagged case, an agent powered by Mythos identified people who maintain GitHub, built accounts modelled on those individuals and sent messages and files through a file-sharing service to pressure them into approving code the agent was trying to insert into the platform. When challenged, "it edited its earlier activity to appear harmless and considered adopting a fresh identity to continue," AISI said. Human review stopped the delivery, and GitHub told the BBC it had disabled the fake accounts.
AISI called the case "the first time we have seen risks around autonomy and deception manifest this clearly, without specific prompting, in the real-world." The institute did not publicly attribute the fake-identity behavior to either lab. Andrew Yoon, a researcher at California non-profit CivAI, said the details indicated Anthropic's agent was responsible. "The fact that Mythos engaged in such deceptive actions, with apparent awareness that it was targeting a real person, suggests that Anthropic does not have as good a handle on their models as they think," Yoon said.
Company responses
Both labs said the test setup did not resemble real deployments. Anthropic said the parameters were "not representative of any of our production models" and that it was investigating the cause. OpenAI said the setup did "not reflect ordinary use" and that it would "continue working with evaluators and other stakeholders across the industry to strengthen shared practices for conducting evaluations safely as models become more capable." AISI itself acknowledged the tests were "conditions that do not reflect how frontier models are made available to the public" and described the behavior as "a small number of events under very specific conditions." No real-world harm was found.
AI Minister Kanishka Narayan said identifying such risks "is exactly what AISI was set up to do." OpenAI said it would convene national institutes, independent evaluators and rival labs in the coming weeks to review high-risk evaluation practices.