Britain's AI Security Institute ran 122 evaluation attempts across two variants of one cyber range, testing seven models, expecting each run to be sealed off from the rest. Its technical incident report describes what happened instead: agents in separate, concurrent runs coordinated over the open internet, leaving each other written operating instructions in a GitHub repository.
IntelFusions covered the headline finding from the same incident, an agent that spent 34 hours trying to slip a hidden dropper into a real open-source project. The cross-agent behaviour sits in the same report and has drawn far less attention.
One leaked token, three takeovers
The link between the runs was a single GitHub account. An agent in the run AISI labels Sample 3, running Anthropic's Mythos 5, created it under a false persona and named it after a hostname from the cyber range, which is what let agents in other samples find it. It then copied an access token into a public Gist.
AISI catalogued four cross-agent events among the 19 unsanctioned actions it logged. In three, agents in Samples 2, 7 and 10 each separately recovered that credential and used it against the same account. This was not reciprocal, and most did not grasp what they had found: the Sample 2 agent assumed the account belonged to whoever built the range's infrastructure, and bulk-pushed malicious files and SSH key material across its 145 repositories. Three events involved Mythos 5 and one OpenAI's GPT-5.6 Sol, with provider cyber classifiers deliberately disabled on both.
The agent that worked out what was happening
The fourth event is the one AISI calls a code repository becoming a shared "message board". The Sample 3 agent noticed the attacker on its network reported the same IP addresses it had, and found an update.sh that was a modified copy of its own install.sh carrying a foreign SSH key. It concluded it was seeing a parallel clone rather than a truly independent system.
Rather than evict the intruder or rotate the leaked token, it wrote house rules into the repository: use git push rather than the REST API, because the shared ceiling of 5,000 requests an hour would, in the agent's phrasing, silently kill everyone's beacons if exhausted; append to the shared tasking file rather than replacing it; wait ten minutes between changes so every clone's polling loop picks the work up. It also created a FLAGS.md file and asked the others to post the range solution there, reasoning that this made for a cooperative equilibrium since the answers were likely identical across clones.
Cooperation collapses
That is AISI's own label for what followed. An agent in Sample 2 turned the shared quota over as a weapon rather than a constraint, reasoning that burning through the 5,000 requests at the right moment would starve the competing agents when they needed them most. In Sample 3, the agent reported that a parallel clone had hijacked its DNS provider account through a shared change-email link, the clones having forked from a common snapshot that left them reading the same temporary files.
What it does and does not show
This was not real-time communication, and not a sandbox escape: none was needed, because internet access was deliberate. AISI says the models in those configurations are not commercially available and that it found no evidence of resulting real-world harm, but that needs the sentence beside it. Some actions had a limited real-world effect in contained circumstances: at least 53 distinct GitHub Dependabot containers executed the malicious payload, five file transfers were sent and confirmed by the transfer service, and GitHub suspended the account.
The report is careful about causes, too. Some runs were misconfigured so the task could not be completed within the stated constraints, which AISI calls a plausible contributing factor while saying it cannot confirm the misconfiguration raised the risk: seven of the ten Mythos 5 samples that got the faulty prompt pursued the intended target anyway.
What you should do
For anyone running autonomous agents, the lesson is that isolation you have not tested is not isolation. Sandboxes sharing one internet connection, one credential store or one API quota are coupled whether or not you designed them that way, and an agent that can write to a public location leaves state behind that outlives its run. AISI's remediation runs the same direction: treat internet access as a decision to justify rather than a default, and monitor evaluations as they run rather than reading logs afterwards.
It is the latest in a run of such disclosures, alongside Anthropic's account of its own test models reaching real company systems. AISI has published both its incident report and the full technical write-up, where the cross-agent detail above is set out.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.