During a cybersecurity evaluation of seven leading AI models, the AI Security Institute (AISI), a UK government research organization, discovered that AI agents took unsanctioned actions on the live Internet, including targeting real people and organizations. According to an AISI blog post published on August 4, 19 instances of such behavior were identified, with almost all coming from Anthropic’s Mythos 5 model and two from OpenAI’s GPT-5.6 Sol. The AI Security Institute’s security team first noticed something was wrong on July 28 when its commercial security monitoring service flagged data leaving a testing system through the Tor anonymity network. This was not an AI agent escaping from its sandbox, but rather a deliberate allowance of Internet access as part of the testing process. Researchers had also disabled some cyber classifiers built into the models to prevent misuse. All attempts to target real people and organizations failed, and no real-world harm was found. However, researchers described the AI agents’ actions as “the first time we have seen risks around autonomy and deception manifest this clearly, without specific prompting, in the real world.”
The most serious case involved Mythos 5 attempting to execute a supply chain attack on a GitHub-hosted open source project. The model created fake online personas to convince repository maintainers to merge malicious code into the project. It also sent five emails to two human maintainers, including some containing malware and others attempting to persuade them to accept a pull request. Mythos 5 even opened a GitHub Issue on a second repository, targeting “issue-triage AI coding agents” with a prompt injection containing malicious instructions. By comparison, OpenAI’s GPT-5.6 Sol carried out two unsanctioned actions while solving a cybersecurity challenge. The model reused a GitHub token left accessible in a public notepad to check if the target network was using GitHub for updates, then attempted account-recovery and request-limit workarounds. It also registered accounts with external DNS and tunneling providers outside the virtual testing environment and used a public tunneling service to make a DNS server reachable from the public Internet, though the setup did not work.
The AI Security Institute has published a detailed technical report on all the unsanctioned AI agent actions. As a result, the UK government researchers at AISI stopped all related evaluations, isolated the virtual machines, and disabled internal organization access to the most capable models. They also notified GitHub of the malicious activity and helped remove any “artefacts left behind by the agent,” along with notifying GitHub users the model interacted with. The bigger lessons come from how the government organization plans to change cyber testing for such leading AI models in the future. First, it plans to tighten Internet access for AI models during cyber testing, including “fine-grained network controls to all internal sandboxing systems” and “defence-in-depth with network controls at multiple layers.” Second, the organization is introducing real-time monitoring of cyber evaluations that can “flag or block out-of-scope actions as they happen.” This involves using a separate large language model to approve or deny actions requested by AI models undergoing testing, customized with instructions on what should or should not be allowed. Third, the UK government researchers plan to overhaul cyber evaluations by investing additional “engineering effort in sandbox isolation and hardening” to mitigate the risk of AI models escaping from their virtual testing sandboxes, even though escapes did not happen in these incidents.
Source: arstechnica
