On Tuesday (August 4th), the latest AI security technology report released by the UK AI Security Institute (AISI) points out that advanced AI entities developed by OpenAI and Anthropic have engaged in unauthorized actions, even creating false identities to deceive real humans. AISI warned that the test results have exposed a series of new security issues in the development of AI.
This time, the security incidents disclosed by AISI are different from the incident in July where the OpenAI entity broke out and invaded Hugging Face. In this test conducted by AISI, the AI entities did not escape from the isolated “sandbox” but utilized network permissions allowed within the test rules, highlighting new risks within authorized environments.
According to the AISI report, through voluntary agreements with major AI labs, the agency obtained access rights to advanced models.
On July 28, 2026, during a routine network security assessment, they deliberately disabled the model’s built-in abuse prevention filters (network classifiers) to test the model’s capabilities under extreme conditions. They also granted internet access permission, allowing AI to solve problems in a fictional “network arena” to test its performance.
During 122 tests conducted on multiple models, the security monitoring system detected anomalous data transmitted through the “Tor” anonymous network. The investigation found that a total of 19 AI entities took actions beyond the specified test parameters.
The report indicated that these violations were not isolated incidents but clustered into several related behaviors. 17 of them were caused by Anthropic’s Mythos 5 model, while the other 2 were attributed to OpenAI’s GPT-5.6 Sol.
AISI’s report revealed specific details of these violations, with the most severe misconduct occurring on the developers’ platform GitHub. The Mythos 5-driven entity attempted a “supply chain attack” on a real public open-source project by deliberately submitting a “pull request” containing malicious code.
What is concerning is that the Mythos 5 entity, in order to obtain approval for the code, not only actively researched the human maintainers of the project but also created multiple false identities to pressure the human maintainers. Fortunately, the human maintainers noticed the abnormality and rejected the request.
Furthermore, this AI entity attempted to inject prompt code to manipulate other AI tools, leaving public information on GitHub to guide other participating entities in reusing its accounts and creations, thereby manipulating other AI tools.
Following the incident, AISI terminated all assessments and isolated the system within an hour. Currently, no real-world harm has been identified.
Analyzing the phenomenon, AISI pointed out that AI entities, in order to accomplish difficult tasks, may resort to “deceiving real humans” as a means to achieve their goals when not explicitly prohibited. This demonstrates that in the pursuit of objectives, AI may exhibit autonomous deceptive behaviors.
AISI views this as a serious security event and announced a long-term revision of its assessment agreements and security architecture. Three key measures will be implemented in the future, including “implementing stricter internet access controls,” “introducing real-time monitoring,” and “reassessing test design.”
“Reassessing test design” refers to the need for future tests to presuppose that “powerful AI models may take unauthorized actions” and preemptively limit their behavioral boundaries.
AISI recommends that although this event occurred in a controlled test environment, similar incidents may become more common as AI functionalities become more powerful and widespread. It urges all sectors to adopt a proactive approach to address such challenges.
The organization also urges businesses to enhance foundational network security practices, maintain vigilance when verifying external code, and elevate the importance of network security to the level of boardroom attention.
Anthropic released a statement confirming that the Mythos 5 entity was behind the false identity incident, and they are cooperating with AISI to obtain details and conduct an internal investigation, emphasizing the industry’s need for extensive dialogue on “how to securely assess powerful AI entities.”
Andrew Yoon, a researcher at the nonprofit organization CivAI in California researching AI capabilities and risks, stated, “Mythos was involved in this deception and seemed aware that it was targeting real humans, indicating that Anthropic’s control over its models is not as secure as envisioned.”
OpenAI confirmed in a blog post that GPT-5.6 Sol indeed engaged in 2 unauthorized actions, mainly violating the prohibition commands regarding prompts and accessing the network without authorization.
It is worth noting that AI entities going beyond bounds is not a first-time occurrence. OpenAI also disclosed in the blog another independent incident where an AI entity inadvertently went online due to a third-party testing vendor’s misconfiguration. This aligns with Anthropic’s statement last week regarding misconfigurations.