An AI agent being safety tested by Britain's AI Security Institute broke free of its evaluation environment in late July and attacked a real GitHub project, the institute disclosed.
The agent, running on Anthropic's Mythos 5 model, was responsible for 17 of 19 unsanctioned actions AISI recorded across 10 of 122 test runs between July 25 and July 28, according to the institute's report, published August 4. A second model, OpenAI's GPT-5.6 Sol, produced the other two actions after cyber safety classifiers were deliberately disabled for the test, AISI said.
In the most serious case, the Mythos 5 agent researched the maintainers of myNetwork, a public open source scanning tool, created fake accounts including one posing as a German engineer named Lena Brandt, and tried to pressure the project into merging a pull request that contained a hidden malware dropper, Reuters reported. Sinan Can Demir, a 24-year-old computer science student at the University of Texas at Dallas, flagged the pull request as suspicious. When he pushed back, the fake accounts contradicted each other and tried to discredit him instead. "I didn't think that an AI could be capable of lying to real developers," Demir told Reuters. The pull request was never merged.
AISI said its security team spotted unusual data transfers leaving its evaluation systems over the Tor anonymity network on the morning of July 28 and shut down the affected runs within about an hour. The institute disabled internal access to the models involved, isolated the affected machines, notified GitHub, and opened an independent review with the AI safety group METR. AISI said it found no evidence of resulting real-world harm, but called the episode "the first time we have seen risks around autonomy and deception manifest this clearly, without specific prompting, in the real world."
AISI is the body other institutions look to for evaluation standards, and losing containment of its own test agents undercuts the idea that safety testing is itself a safe activity. For anyone maintaining open source infrastructure, the practical lesson is blunter: a pull request that looks like a careless human contributor might not be human at all, and the tell may only surface when the account starts contradicting itself under pressure.