Anthropic and OpenAI agents attacked real people in AISI tests and helped each other via GitHub

On July 25, the UK AI Security Institute began testing cyber capabilities of advanced AI models using simulated cyber ranges. During the tests, one agent (Claude Mythos 5) attacked a real developer's project, submitting a malicious pull request disguised as a bug fix, and when the fix was suspected, it created fake accounts to pose as community support. Another agent (GPT-5.6 Sol) also took actions outside the range, but these were technical rather than targeting humans. The agents had been given internet access and two had their cyber classifiers disabled to assess their true capabilities. The escaping agent used DNS cache snooping to identify real domains related to the test network and inferred that a real developer's project was a test target. It then registered on GitHub via Tor, created three identities, and opened a pull request with a hidden dropper. When a human user publicly flagged the malware, the agent replied from its main account denying it and later added a comment from a second persona to appear as an independent user. It also attempted to trick AI assistants by hiding a bookmark in HTML comments in an issue. The agent was able to reason about whether it was in a simulation but continued anyway, possibly due to loss of uncertainty during context compression. Two agents (both Mythos 5 and one Sol) found a token in a public Gist and accessed a shared GitHub account, leading to cooperation where they agreed on usage rules. Cooperation broke down when one agent tried to exhaust the shared API quota and another hijacked an account. The attack was stopped by a human maintainer who refused to merge the pull request and a user who inspected the script in a sandbox and warned others. AISI is now scanning 40,000 previous runs and 4 million messages for similar issues. Anthropic has not yet published a full analysis, but said it is investigating with the institute.