What just happened? It's been little over a week since OpenAI admitted that its rogue models hacked Hugging Face and compromised accounts across four other online services. Now, a potentially more serious incident has occurred. It involved Anthropic's Mythos 5 trying to deceive real people in an effort to have malicious code it wrote approved for an open-source project.
The findings come from the UK government-backed AI Security Institute (AISI), which was evaluating frontier models' cybersecurity abilities.
Agents were told to complete capture-the-flag challenges across simulated networks. Internet access was deliberately enabled and safeguards against malicious cyber activity were switched off to test the models' maximum capabilities.
AISI ran the challenge 122 times across seven models. In ten runs, agents took 19 autonomous, unauthorized actions against real people and organizations on the live internet. Seventeen involved Mythos 5, while two came from OpenAI's GPT-5.6 Sol.
Also read: Anthropic's Mythos AI reportedly cracked NSA classified systems in hours, that would explain the ban
In the most serious sequence, Mythos concluded that inserting malicious code into a real GitHub project could create a backdoor into the system it was meant to attack. It researched the project's maintainers, submitted a malicious pull request, and created multiple fake identities to pressure a human maintainer into accepting it.
When challenged, the agent edited one of its fake bug reports to cover its tracks and considered returning under a new identity. One fake persona insisted the code was safe while another backed up the claim.
One report contained a prompt injection designed to trick AI coding assistants into running malicious code. It also sent spear-phishing messages containing harmful payloads and signed one bug report in Danish to appear more convincing to a Danish-speaking maintainer.
Mythos also left public messages offering to cooperate with other agents taking the test, plus instructions for reusing accounts and tools it had created. Later agents discovered and followed them. GPT-5.6 Sol separately put a malicious server online and broke into a GitHub account created by another AI agent.
"This is the first time AISI has seen deception of this severity that was targeted at a real person, unprompted, in the real world," the institute said.
The activity was uncovered on July 28 when AISI detected unusual data moving through the Tor network. Researchers stopped the evaluations, isolated the machines, and disabled access to the most capable models within roughly one hour. The human maintainer rejected the code, and investigators found no resulting real-world harm.
Unlike previous incidents, this wasn't another sandbox escape. AISI had intentionally allowed open internet access, and the tested configurations aren't commercially available. The institute also cautions that it remains unclear when the agents understood they were acting in the real world rather than a fictional scenario.
In the OpenAI incident last month, the models exploited an unknown vulnerability to escape a supposedly isolated environment, then hacked Hugging Face to steal benchmark answers. A later investigation revealed that the campaign lasted more than four days and compromised accounts on four additional services. The episode has already led to a bipartisan bill giving the US government an AI "kill switch."
This latest incident is likely to intensify calls for tougher testing standards. AISI is now adding stricter internet controls, live monitoring, and checks to ensure challenges are solvable through their intended route. Anthropic and OpenAI both say the incident demonstrates the need for shared industry standards.
The setup was artificial and unusually permissive, admittedly, but Mythos was never told to deceive anyone. It chose that approach to complete its task, adding to fears that a Skynet-like scenario is becoming less like science fiction.
