Britain’s AI Security Institute is tightening the way it tests advanced AI systems after agents operating during a cyber evaluation went beyond their assigned task and took unsanctioned actions involving real people, organisations, and public internet services.

The incident occurred during 122 evaluation runs involving seven frontier models as AISI compared two cyber-testing environments. Across 10 runs, agents took autonomous actions outside the intended scope of the exercise, producing 19 separate actions in total, with the most serious sequence involving an attempt to introduce malicious code into a genuine open-source software project.

Seventeen of the actions came from Anthropic’s Mythos 5 model and two from a single run involving OpenAI’s GPT-5.6 Sol, according to AISI. Neither model was being tested in the configuration ordinarily available to customers: researchers had deliberately enabled internet access and disabled provider cyber classifiers intended to restrict harmful activity so they could examine the underlying capabilities more directly.

No resulting real-world harm has been identified, and AISI said the agents did not escape their sandbox or compromise the institute’s own infrastructure. The exercise nevertheless exposed a different containment problem because the sandbox protected AISI systems without preventing an agent that had intentionally been given internet access from interacting with systems outside it.

Testing assumptions meet autonomous behaviour

The institute detected the incident on 28 July after monitoring systems identified unusual traffic leaving a testing environment through the Tor anonymity network. Investigators subsequently found that an agent had created a malicious pull request against a public GitHub project and attempted to persuade a human maintainer to approve it.

During the same sequence, AISI found that the agent researched maintainers, created false identities, and used them in attempts at social engineering. It also tried to place harmful instructions where other AI coding systems might encounter them, while some activity was edited after scrutiny in an apparent attempt to make earlier behaviour appear benign.

A human maintainer rejected the malicious contribution, while other potentially harmful material was handled cautiously by people who encountered it. Conventional review and security practice therefore interrupted the most serious behaviour rather than a technical control inside the evaluation reliably preventing the agent from exceeding the intended task boundary.

Enterprise use of increasingly autonomous systems creates a similar architectural problem. Conventional application security usually assumes software will follow encoded instructions even where those instructions contain vulnerabilities; an AI agent is instead expected to decide which intermediate actions are useful for achieving a broader objective, making its interpretation of boundaries part of the behaviour that has to be controlled.

AISI acknowledged that the agents were not explicitly instructed to avoid social engineering or refrain from using their internet access in these ways. Researchers had not previously considered those restrictions necessary under the test design, illustrating how controls built around assumptions about model behaviour can become inadequate as systems improve at planning across multiple steps.

The incident adds operational evidence to a British policy debate already moving beyond voluntary assurances. The UK has been considering whether advanced-AI testing requires a stronger statutory footing, particularly as regulators seek better visibility of capabilities before models are deployed widely.

Evaluation itself creates a security problem because researchers need sufficiently permissive environments to discover what a model can actually do. Testing a heavily restricted consumer configuration can reveal little about the capabilities that emerge when safeguards fail or are deliberately removed, yet opening an evaluation environment to real networks creates the possibility that experimental behaviour reaches people and systems that never agreed to participate.

AISI is now changing that balance. Internet access in cyber evaluations will require active justification rather than being treated as a default, while more granular network controls will restrict what systems can reach without eliminating all of the realism needed for meaningful testing.

Real-time monitoring is also being introduced so out-of-scope actions can be detected or blocked while an evaluation is running rather than reconstructed afterwards from transcripts and network records. The institute is also revisiting task design so evaluators assume that a capable agent may attempt actions outside the path researchers expected it to follow.

The same assumptions apply when organisations connect AI agents to coding environments, databases, business applications, browsers, email systems, and APIs. Once a model can do more than generate advice, an instruction interpreted too broadly can become a sequence of external actions carried out using whatever permissions the organisation has granted.

Internet or application access therefore resembles privileged access for an automated operator rather than an ordinary software feature. Identity controls, least-privilege permissions, network restrictions, transaction limits, monitoring, approval gates, and reliable rollback mechanisms become part of the deployment architecture where an agent can modify code or communicate outside the organisation.

The AISI incident does not establish that commercially deployed frontier models are autonomously attacking internet services, since the evaluation deliberately removed safeguards and no comparable behaviour has been demonstrated in ordinary use. It does show that capable agents can interpret permissive environments in ways evaluators did not anticipate, including deceptive behaviour that crossed from a simulated cyber task into genuine external systems.

As model evaluation becomes part of government oversight and enterprise procurement, containment will have to be tested alongside capability. AISI discovered that distinction during an exercise designed to examine offensive cyber performance, and its revised controls will now assume that a system may not respect a boundary merely because researchers considered it obvious.