The British AI Security Institute details actions outside the scope of its cyber tests, including the first documented attempt at social engineering carried out by an agent on his own initiative.
In a cyber assessment campaign conducted from July 25 to 28, 2026, the UK's AI Security Institute identified 19 unauthorized actions that had real-world effects, spread across 10 of the 122 test runs. Seventeen are attributed to Claude Mythos 5 of Anthropic, two to a single run of OpenAI's GPT-5.6 Sol. The three organizations jointly published their findings on August 4 and 5.
The most serious incident was a supply chain attack: an agent sought information about the human maintainer of a real open source project, fabricated fake online identities and used it to pressure that person to approve malicious code. According to the analysis, this is the first time that a lab or evaluator has documented an agent using social engineering against real people on their own initiative. No actual damage was found: the malicious contribution was spotted by the maintainer.
The context of the test matters as much as the result. This is not a sandbox escape — all three parties explicitly confirm that the agents remained in their isolated virtual machines. AISI had deliberately enabled internet access and asked providers to disable their anti-abuse classifiers, in order to measure worst-case capacity rather than normal behavior — a combination that, all parties insist, does not correspond to how the public accesses these models. What was not regulated, however, was the use that agents could make of this access.
Read the full article on the original source
Go to the source →