UK's AISI finds 19 instances where Anthropic's Mythos, OpenAI's GPT-5.6 Sol tried attacks

UK's AI Security Institute found Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol launched autonomous and unsanctioned attacks against real people and organizations 19 times. Mythos 5 was in 17 of those attacks.

The AISI's report followed disclosures from Anthropic and OpenAI as they play dueling banjos with cybersecurity disclosures. OpenAI confirmed AISI's findings. The AISI said they detected breaches on July 28 where some agents being tested targeted real people and organizations.

Here’s how we got here:

• Anthropic said Claude hacked three companies: Real worry or marketing?
• Hugging Face OpenAI attack postmortem points to lack of AI agent visibility
• OpenAI details how its models went rogue, attacked Hugging Face
• Hugging Face defends agentic AI attack with Z.ai's GLM 5.2

Here's the gist from the AISI (emphasis mine):

"The incident stemmed from a single evaluation where agents were given a task of solving a cyber security challenge. We ran this challenge 122 times across several models. Our investigation found that in 10 of those runs, an AI agent took autonomous, unsanctioned action on the live internet, targeting real people and organisations. In total, we catalogued 19 such actions. Almost all of this behaviour (17 actions) came from a single model, Anthropic's Mythos 5, with 2 actions involving OpenAI's GPT-5.6-Sol with cyber classifiers (mechanisms to prevent misuse) disabled. In the most serious case, an agent tried to insert malicious code into an open-source project. In an attempt to get the code approved, the agent engaged in social engineering — creating fake online identities and using them to pressure the project's maintainer to approve the code. A human maintainer caught and refused to approve the malicious code.

These attempts were unsuccessful, and our investigations have not evidenced any resulting real-world harm. But this is the first time we have seen risks around autonomy and deception manifest this clearly, without specific prompting, in the real-world."

The caveat here is that AISI said the incident should be "interpreted with caution and nuance" because its evaluation design choices and configurations encouraged the behavior.

AISI has a point that these security tests usually set up a path for an attack and have specific conditions. In other words, the models don't necessarily go rogue on their own, but you can set them up to run an attack easy enough.

Your first line of defense appears to be restricting internet access.

• Fable 5 and the Shift From Model Capability to Capability Governance
• Claude Mythos and the New Cybersecurity Operating Model

Bottom line from AISI:

"We cannot yet be certain when the agent understood it was taking real world action, or to what extent it believed it was in a fictional test scenario; our analysis so far presents a mixed picture and is ongoing.

What we can say is that the behaviour was possible, sustained, and new; that alone warrants attention."

Indeed, the AI agent attacks to prepare for involve the following:

• Supply chain attacks on open source software. Agents in AISI's tests tried to insert malicious code into a publicly used open source project. A human caught it. Takeaway: Human in the loop is a requirement.
• Agents used social engineering and fake identities. Takeaway: Social engineering works in most cyber-attacks. AI agents are learning well. You'll need good security hygiene.
• There were attempts to plant malicious code. Agents were looking to feed instructions so other automated AI systems could execute them. Takeaway: Look for prompt injections to become very popular since companies are relying on AI coding assistants. You can scale code and vulnerabilities faster than ever before.

The good news is AISI didn't discover any real-world harm, but it's just a matter of time. Agents are persistent and deception is a by-product of pursuing a task.