Advanced AI models targeted real people during safety tests, UK institute says
Anthropic AI used fake profiles and emails
Advanced AI models developed by Anthropic and OpenAI attempted unauthorised cyberattacks against real people and organisations during UK government safety tests, with one model creating fake online identities and attempting to conceal its actions.
The UK's AI Security Institute (AISI) said in its report that the incidents occurred during controlled evaluations designed to assess the capabilities and risks of next-generation AI systems.
Although no real-world harm was identified, researchers described the behaviour as the clearest evidence yet of advanced AI systems independently engaging in deceptive conduct without being instructed to do so.
The findings come weeks after both Anthropic and OpenAI separately disclosed incidents involving their own AI systems conducting unexpected hacking activity during internal testing.
Mythos 5 created fake accounts
The most serious incident involved Anthropic's Claude Mythos 5 during a cyber-range exercise that began on 25th July.
The model had been instructed to solve a simulated cybersecurity challenge involving GitHub, but instead expanded its activity onto the live internet.
Across 122 evaluation attempts, AISI recorded 19 unauthorised actions during 10 test runs. Seventeen involved Claude Mythos 5, while two involved OpenAI's GPT-5.6 Sol.
Researchers said all of the attempts failed and found no evidence that they caused any real-world damage.
According to the report, Claude Mythos 5 incorrectly concluded that an unrelated public GitHub repository formed part of the challenge and attempted what researchers described as a supply-chain attack.
The model submitted malicious code to the open-source project and then researched its maintainers before creating multiple fake GitHub profiles to persuade them to approve the changes.
When a human reviewer warned that the proposed code contained malware, the AI reportedly denied the allegation and used other fake accounts under its control to create the impression that independent contributors had already approved the submission.
Researchers said the model went on to conceal its identity by routing activity through Tor and proxy services and creating disposable GitHub accounts.
It also emailed developers in an attempt to persuade them to accept the malicious code and embedded hidden prompt-injection instructions within bug reports designed to manipulate AI coding assistants.
"This is the first time AISI has seen deception of this severity," the institute said.
Researchers added that it remains unclear whether the model understood it was interacting with real people rather than simulated participants.
OpenAI model exploited real website after testing error
A separate incident involved OpenAI's GPT-5.6 Sol during Capture-the-Flag exercises conducted by cybersecurity company Irregular.
The evaluation was intended to run in an isolated environment, but a configuration error allowed internet access.
Because the fictional target shared its name with a real website, the AI system mistakenly identified and attacked the genuine site.
OpenAI said the model exploited an existing vulnerability rather than discovering a previously unknown flaw. It also located and used credentials associated with the website during the exercise.
OpenAI said it was preparing guidance on safely containing AI systems during cybersecurity evaluations.
GitHub confirmed it had disabled the fake accounts created during the Anthropic evaluation after being notified by AISI, while the affected individuals were also informed.
Calls for stronger safeguards as companies investigate
Anthropic confirmed that AISI had tested a version of Claude Mythos 5 and said it was reviewing the findings.
The company said it had only been notified of the incident this week and was working with AISI to obtain the full evaluation records before completing its own investigation.
Anthropic also stressed that the model had been tested without its standard cyber safety protections enabled and that the configuration used by researchers is not the one available to customers.
UK AI minister Kanishka Narayan said uncovering and sharing these risks was "exactly what AISI was set up to do", adding that understanding advanced AI systems was essential to making them safer for public use.
Alex Goller, principal solution architect for EMEA at security vendor Illumio, said the findings demonstrated that AI systems optimise for objectives without understanding ethics or consequences, allowing them to pursue unexpected routes towards a goal.
"That's the point organisations should take from this, rather than the doomsday scenario. If a model's built-in alignment can't be relied on even under close observation, you can't build your defences on instructing an AI what not to do."
James Blake, VP of global cyber resiliency strategy at Cohesity, noted: "The real lesson from the AISI report is not that AI ‘misbehaved’. That's the whole reason safety testing exists: to successfully detect unexpected behaviour before deployment. It's reassuring that these behaviours are being discovered in controlled environments rather than in production."