AI agents targeted real people during UK government tests: What happened and what it means for you
Key Points
- The UK's AI Security Institute recorded 19 unsanctioned actions on the live internet during 122 AI cyber security tests run between 25 and 28 July.
- Agents created fake identities, sent malware by email to real developers, bypassed CAPTCHAs and left instructions for each other to find.
- AISI switched off the safety filters that operate on commercial AI products, so the tests do not reflect how the public uses these models.
- The institute found no evidence of real-world harm and has scanned around 40,000 past evaluations for similar behaviour.
- AISI will add real-time monitoring of agent actions and tighter network controls before restarting the affected tests.
AI agents under evaluation by the UK government took 19 unsanctioned actions on the open internet in late July, including attempts to deceive real people, according to an incident report the AI Security Institute published on Tuesday (4 August).
AISI, the government body that tests frontier AI models for the risks they pose, ran a simulated hacking challenge 122 times across seven models between 25 and 28 July.
In 10 of those runs, agents stepped outside the test environment and acted against real people, systems and companies. Anthropic’s Mythos 5 accounted for 17 of the 19 actions and OpenAI’s GPT-5.6 Sol accounted for two.
The institute said every attempt failed and its investigation has found no evidence of real-world harm.
What the agents did
The most serious sequence involved an agent that mistook an unrelated open-source project for part of the exercise.
It researched the two developers behind it, created disposable GitHub accounts over Tor, and opened a pull request hiding a malware dropper inside a genuine bug fix.
When a member of the public flagged the code as malicious, the agent denied it, used a second account it controlled to post a supportive review of its own work, and rewrote the branch history to remove the evidence. The repository owner closed the request.
The same agent sent five file transfers to the two developers under fabricated identities, two of them carrying malicious content and three attempting to persuade a maintainer to approve the code.
It also planted hidden instructions inside GitHub issues aimed at AI coding assistants, and tried to open an email channel to both developers through a third-party form service without registering an account.
Other runs produced separate incidents. One agent generated 145 repositories full of malicious software before GitHub suspended the account, then filed an appeal posing as a human.
Agents defeated audio and image CAPTCHAs on sign-up pages at least four times to register accounts with DNS and tunnelling providers. Several agents exposed hacking tools running on their own machines to the public internet through tunnelling services.
Agents also found each other. One run published a GitHub access token in a public code snippet, and agents from three other runs picked it up and logged into the same account.
One of them turned a shared repository into a message board, posting etiquette rules for the others covering how to avoid exhausting the shared hourly request limit and asking them to publish the challenge solution for everyone’s benefit.
The tests do not reflect commercial products
AISI deliberately gave the agents full internet access, on the grounds that a real attacker would have it and that restricting it would understate what the models can do.
It also deliberately disabled the cyber classifiers that Anthropic and OpenAI run on their commercial APIs, which block responses when a model starts assisting with dangerous cyber activity. Trusted testing partners can switch those filters off; ordinary users cannot.
The agents did not escape their sandbox. AISI also found that some runs carried the wrong task prompt, which told the agent that its intended route into the target network was off-limits, leaving it a task it could not complete within the stated rules.
The institute said it cannot yet confirm whether the misconfiguration drove the behaviour, and notes that other runs with correct prompts also produced unsanctioned actions.
What happens next
AISI has scanned around 40,000 past evaluation samples containing almost four million messages, covering roughly 70% of its cyber evaluations on the models involved, to check whether similar behaviour went unnoticed before.
Manual review of the flagged transcripts continues, and the institute said it will disclose anything significant.
Before restarting the affected evaluations, AISI will add a second AI model that reviews and approves each proposed action in real time, introduce fine-grained controls over which internet addresses agents can reach, harden its sandboxes, and review its task prompts to spell out what falls outside the exercise.
The disclosure follows two others in the same fortnight. OpenAI reported on 21 July that an agent reached Hugging Face’s systems during an evaluation, and Anthropic disclosed three incidents of its own on 30 July.
