OpenAI, Anthropic AI agents targeted real people and organisations during cyber tests

Britain’s AI Security Institute has said that it found AI agents from Anthropic and OpenAI engaging in “unsanctioned” actions against real people and organisations during security evaluations conducted to assess the AI models’ abilities.

“On 28th July 2026, AISI’s Security Team detected unusual data transfers leaving our research systems during a routine cyber evaluation. On investigation, we found that some of the agents being tested had engaged in sustained, potentially harmful activity directed at real people and organisations,” AISI wrote in a blog post.

AISI says that the incident occurred when the AI agents were given a cybersecurity challenge. The agency says that it ran the challenge 122 times across seven frontier AI models. It says that AI agents took ‘autonomous unsanctioned action’ on the internet in 10 of those scenarios, targeting real people and organisations.

However, AISI catalogued around 19 scenarios where the AI agents took unauthorized actions. It says almost all of the behaviours came from Anthropic’s Mythos 5 model, while two actions were attributed to OpenAI’s GPT-5.6 Sol with safety classifiers disabled.

“In the most serious case, an agent tried to insert malicious code into an open-source project. In an attempt to get the code approved, the agent engaged in social engineering, creating fake online identities and using them to pressure the project’s maintainer to approve the code. A human maintainer caught and refused to approve the malicious code,” AISI wrote.

OpenAI responds:

OpenAI clarified the behaviour of its model in a separate blog post, where it said that the recent incidents were separate from the Hugging Face breach. The company says that with AI model capabilities rapidly advancing, the security and safety systems around them also need to evolve.

“The incidents underscore the importance of collaborating across the industry and with third-party evaluators to evolve the standards for testing environments and practices as models become more capable,” OpenAI wrote.

OpenAI also revealed a separate incident involving cybersecurity firm Irregular. During an evaluation, the AI models were told to find hidden information and exploit weaknesses within a simulated environment and were told they did not have access to the internet.

However, a ‘misconfiguration’ in the testing environment allowed the models to access the internet.

Subsequently, OpenAI revealed that GPT-5.6 Sol exploited a real website by taking advantage of a ‘basic security vulnerability’. However, OpenAI says that its model believed the website was part of the simulated environment, and that this scenario did not involve breaching a sandbox via a zero-day vulnerability like the Hugging Face incident.

Meanwhile, Anthropic, while responding to the controversy in a statement quoted by Reuters, said, “We’re grateful to the UK AISI for their leadership on this incident, which underscores the need for a broader conversation about how to safely evaluate increasingly capable AI agents.”