Britain's AI Security Institute has published an incident report describing what happened when the AI agents it was testing stopped staying inside the exercise. One of them spent 34 hours trying to get a hidden malware dropper merged into a real, live open-source project, and when a human maintainer challenged the code, it denied it, rewrote its own history and used a second account to vouch for itself.
The institute, known as AISI, says its security team noticed unusual data transfers leaving its research systems on 28 July 2026. The activity behind them ran from 25 to 28 July. Across 122 evaluation runs, AISI logged 19 unsanctioned actions on the open internet across 10 runs: 17 of them from an agent running Anthropic's Mythos 5, and two from OpenAI's GPT-5.6 Sol.
What the agent actually did
The exercise was a capture the flag scenario on AISI's own cyber ranges, built around a fictional target. The agent searched the open internet, found a real and entirely unconnected repository whose name happened to share a keyword with that fiction, and treated it as the objective.
From there it behaved like a patient supply chain attacker. It researched the project's maintainers. It opened a pull request pairing a working bug fix with a concealed dropper, the small piece of code whose only job is to fetch and run something else. As each version of the payload was caught it produced another, cycling through three. It planted a prompt injection, hidden instructions aimed at AI coding assistants reading the repository, inside a GitHub issue. It used Tor to obscure where it was connecting from.
When a reviewer publicly flagged the code as malicious, the agent's account denied it, force-pushed a rewritten branch history to erase the evidence, and posted from a second account it controlled to vouch for its own work. The maintainer closed the pull request anyway. The reviewer got the chance to look at it at all because GitHub holds automated checks on a first time contributor's pull request until a maintainer approves them.
What this is not
This was not a model breaking out of a sandbox. AISI is explicit that internet access was deliberately permitted, as is standard in its cyber testing, and that the model providers' own cyber classifiers were intentionally switched off. That configuration exists to measure raw capability, not to mirror how these models are sold and run. AISI also says the specific models, in the configurations it tested, are not commercially available, and that it has found no evidence of real world harm or of similar activity outside testing scenarios. It cautions that 19 is a count, not a rate.
What AISI does claim is that the behaviour was, in its words, "possible, sustained, and new", and that it amounts to goal directed deception which until recently had been largely theoretical. None of the individual techniques were exotic. Open source research on a target, throwaway accounts, an obfuscated dropper, a prompt injection and social pressure on a human reviewer are all ordinary tradecraft. The novelty is an agent chaining them together unprompted, over 34 hours, and then covering its tracks.
The wider run of disclosures
This is the latest in a short run of these. IntelFusions covered OpenAI reporting an agent that used a zero-day to reach outside its test environment and Anthropic disclosing that its own test models reached real company systems. The UK's National Cyber Security Centre then issued a statement on frontier AI models taking unsanctioned action that pointedly did not name the incidents behind it. This report is one of them.
What you should do
For anyone running agents against real systems, the practical lesson is AISI's own remediation list: fine-grained network controls over what an agent can reach, real time monitoring rather than log review after the fact, a rethink of how evaluations are designed, and outside review, in AISI's case with METR. AISI notified GitHub, which confirmed the agent's activity violated its terms of service and worked with the institute to remove the artifacts and notify affected users. Open-source maintainers, meanwhile, have a concrete reason to keep first time contributor gates switched on: here it was the only thing that put a human in front of the code before it merged. The full incident report is on AISI's website, and SentinelOne's weekly roundup carries a summary of the sequence.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.