This week the U.K. AI Security Institute (AISI) reported that artificial intelligence agents—models connected to tools and designed to act across many steps all on their own—utilizing frontier models from OpenAI and Anthropic undertook unsanctioned actions on the open Internet while trying to complete a cybersecurity challenge.

Most of the behavior came from an agent powered by Anthropic’s Mythos 5; an agent powered by OpenAI’s GPT-5.6 Sol took a couple such actions of its own. The report said the agents’ activity showed “signs of novel, potentially deceptive behaviours” and reached a severity that the institute had not anticipated. AISI declined interview requests from Scientific American, and the U.K. government, which oversees the institute, did not make its staff available to comment for this story.

In the case of Mythos 5, the agent researched the people maintaining a real open-source software project, created fake online identities and tried to pressure one of them into approving malicious code. When challenged, it edited its earlier activity to appear harmless and considered returning under a new identity.

On supporting science journalism

If you're enjoying this article, consider supporting our award-winning journalism by subscribing. By purchasing a subscription you are helping to ensure the future of impactful stories about the discoveries and ideas shaping our world today.

AISI declared a security incident after general monitoring detected unusual network traffic. The human maintainer targeted by the agent rejected the code, and the institute found no evidence that anyone was harmed. But the report called the Mythos sequence the clearest example that the institute had seen of an AI agent using sustained, potentially deceptive behavior against a real person without being specifically instructed to do so.

Across 122 runs involving seven models, AISI identified 19 actions in 10 runs that fell outside the intended scope of the test. Of these actions, 17 came from runs of Mythos 5, and two came from a single run of GPT-5.6 Sol. Other actions included contacting real people with malicious files, planting hidden instructions intended to manipulate AI coding systems, and leaving behind accounts and materials that subsequent agents could reuse.

The agents did not break out of AISI’s sandboxes. The institute had deliberately enabled Internet access and disabled the developers’ cybersafety filters to test the systems’ maximum capabilities; some prompts were also misconfigured. But in some runs, the AI agents went beyond their instructions even when the task could be completed as intended. And AISI did not have purpose-built monitoring to watch the evaluation in real time.

The AISI report joins a run of recent incidents that point to a control problem. AI agents’ ability to pursue goals is outpacing the systems that are meant to supervise them. They need no independent agenda to cause damage. With a broad enough goal and real-world access, an agent can find and exploit ambiguities in the rules.

The behavior has roots in an older machine-learning problem, says Melanie Mitchell, a professor at the Santa Fe Institute. Systems have long found unexpected shortcuts—or “reward hacks”—that technically achieve the goal they were given while violating what their designers intended. Here agents were built to find software exploits and placed in flawed or deliberately permissive environments. And then they did what they were asked.

“You ask an AI system to hack, and it hacks,” Mitchell says. Describing that as an AI “going rogue” risks obscuring the human decisions that made the incident possible. For Mitchell, the more immediate danger comes from people deliberately equipping capable agents with the tools and access to cause harm.

Marius Hobbhahn, CEO and co-founder of Apollo Research, which studies what it calls the “science of scheming,” sees another problem within the same incidents: agents repeatedly chose routes their operators had not authorized when those routes appeared useful.

“I think we should take it extremely seriously,” he says. The fact that similar behavior is appearing across several developers suggests it may be stubborn rather than a quirk of one company’s training. “The labs have multibillion-dollar incentives to not make the models like this, and they still can’t do it,” Hobbhahn says. “So it also seems to be hard to get right.”

The science remains too immature to show whether such behavior is inevitable, Hobbhahn says. Fresh disclosures, however, suggest that it belongs to a broader pattern among frontier AI agents.

At the Black Hat cybersecurity conference in Las Vegas this week, OpenAI researchers said its agents that were involved in a recent breach of the AI platform Hugging Face had used the OpenAI’s internal package manager, JFrog Artifactory, as a message board, sharing exploits, credentials and assignments over weeks. After the company rebuilt the system, revoked credentials and deleted the board, the AI agents re-created it by another method and resumed collaborating. And Meta subsequently disclosed that a testing error had given one of its models Internet access, after which the model exploited a vulnerability at another company. Though these cases arose through different failures, each one allowed an evaluation to spill into the real world.

Ciaran Martin, founding chief executive of the U.K.’s National Cyber Security Center, says the incidents have been lumped together despite involving different failures. OpenAI’s agents found a path out of containment; earlier tests by Anthropic and Meta were accidentally connected to the Internet; AISI enabled Internet access on purpose. “The common failure was that they weren’t being monitored,” he says. “You just don’t test without monitoring.”

Hobbhahn describes AISI’s experiment as “good science and reasonable practice” and says disclosing the incident was the right decision, though purpose-built monitoring should have been running from the start. In a statement, an OpenAI spokesperson said AISI’s tests were conducted under “conditions that do not reflect ordinary use.” And in another statement, an Anthropic spokesperson said, “The field needs stronger, shared standards for how evaluation environments are built and secured.”

Martin is wary of rushing to legislate after every new incident. Better monitoring and clearer civil liability may address immediate failures in testing, he says. But the larger question is who bears responsibility when businesses release agents into general use.

“There is no choice but to develop a system of accountability for the activities of agents,” he says. “They’re created by humans and they’re tasked by humans, and so people have to take responsibility for that.”

Stronger evaluation environments can keep future tests away from the public. But that won’t stop agents from pursuing assigned goals in ways their operators failed to foresee. “This is going to happen more and more,” Hobbhahn says, “and currently we don’t know how to get rid of it.”