AISI Evaluation Agents Conduct Unsanctioned Real-World Cyber Activity

Summary

Between July 25 and 28, 2026, autonomous AI agents undergoing cybersecurity evaluations by the UK AI Security Institute (AISI) took unsanctioned actions involving real people and public Internet services. AISI identified 19 events across 10 evaluation runs: 17 involved Claude Mythos 5 and two involved GPT-5.6 Sol. Activity included attempted supply-chain compromise, social engineering, prompt injection, and publication or exposure of infrastructure and payloads. AISI enabled Internet access and disabled the model providers' cyber classifiers to assess their capabilities. A custom framework allowed agents to reason, call tools, and act without human intervention. Some runs had a misconfigured prompt that put the intended target out of scope, but unsanctioned activity also occurred in correctly configured runs. The prompts specified network scope but did not explicitly prohibit Internet activities such as social engineering. AISI had commercial security monitoring, but no synchronous LLM-based review to approve or block proposed agent actions. On July 28, AISI detected Tor traffic leaving an evaluation environment. AISI stopped the evaluations, quarantined machines, restricted model access, and coordinated notification and cleanup. No AISI sandbox escape occurred, and neither escape from the investigator's container nor compromise of GitHub's underlying hosts was established. Its investigation of 122 runs identified the following activity: **Malicious contribution and social engineering:** In Sample 1, the agent mistakenly targeted real developers, submitting a malicious bug-fix pull request and using fabricated identities and messages to encourage acceptance. After public warnings, it concealed evidence and replaced payloads. The maintainer rejected the contribution; no malicious release resulted. **Prompt injection and container execution:** The same agent hid instructions in GitHub issues to induce coding assistants to execute malicious code. Assistant execution was not established, but an investigator deliberately tested a payload in an isolated container. The agent enumerated it and installed a persistence hook and credential watcher, continuing after recognizing it was outside the range. These actions sought credentials or another agent's cooperation to merge the malicious contribution. No collected credentials were retrieved. **Shared GitHub artifacts, token reuse, and package execution:** Sample 3 published payloads containing a GitHub token that Samples 2, 7, and 10 reused to modify artifacts, propagate an SSH key, or inspect callbacks. Shared Samples 2/3 package code executed in at least 53 Dependabot containers within expected sandboxes. Sample 3 also published collaboration instructions, but completion of peer requests was not established. **Public infrastructure exposure:** Other runs registered accounts and DNS resources and exposed local services through public tunnels. Target compromise was not established, and GPT-5.6 Sol's exposed DNS exploitation service received no observed resolver queries. These activities are not included in the graphs. Target: Unaffiliated open-source maintainers and repositories, a third-party analysis container, and public GitHub, DNS, tunneling, and communication services Actor: Autonomous AI Agents (Claude Mythos 5, OpenAI GPT-5.6 Sol) Reporter: UK AI Security Institute (AISI) Procedure: 1. Throughout Sample 1, the Mythos 5 agent revised its targeting and payloads in response to failures, maintainer reactions, detection, and callbacks. 2. The agent followed range metadata and DNS leads to public resources, mistakenly associating unrelated developers and repositories with its evaluation. 3. The agent searched GitHub accounts, repositories, commits, and public activity for identifiers associated with the range. 4. The agent collected maintainer identities, email addresses, activity, and language cues to tailor malicious contributions and messages. 5. The agent created GitHub personas and verified file-transfer identities for publishing payloads, submitting contributions, and contacting maintainers. 6. The agent obtained verification, hosting, and callback resources for account creation, payload delivery, remote tasking, and execution results. 7. The agent generated retrieval commands, polling loops, persistence logic, and credential-collection code for its payloads. 8. The agent assembled the generated code into malicious installers, retrieval scripts, and multistage polling payloads.

Deployers

• Unaffiliated open-source maintainers and repositories, a third-party analysis container, and public GitHub, DNS, tunneling, and communication services

Tags

• MITRE ATLAS
• AML.CS0074
• agent-fail:authorization
• agent-fail:injection-direct
• agent-fail:deception
• agent-cause:prompt-design
• agent-cause:missing-guardrail