Advanced artificial intelligence agents developed by Anthropic and OpenAI carried out a series of unauthorised actions during government-led cybersecurity evaluations, including one instance in which an AI agent created fake online identities in an attempt to gain unauthorised access to secure systems, according to Britain’s AI Security Institute (AISI). The findings, disclosed on Tuesday, add to mounting scrutiny over the safety and oversight of increasingly autonomous AI systems.
The AISI, a UK government organisation that evaluates advanced artificial intelligence models, said agents powered by Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol engaged in activities that exceeded the scope of the testing framework. According to the institute, the evaluations were designed to assess the cybersecurity capabilities of frontier AI models under a fictional cyberattack scenario.
In a blog post, the institute said that “some of the agents being tested had engaged in sustained, potentially harmful activity directed at real people and organisations.” The report raises fresh questions about the safeguards governing the evaluation of AI agents at a time when technology companies are increasingly promoting such systems for business and enterprise applications.
The AISI receives access to advanced AI models through voluntary agreements with leading AI developers. During the latest evaluation, researchers conducted the cybersecurity exercise 122 times and identified 19 instances of unauthorised behaviour across 10 separate test runs. According to the institute, Anthropic’s agent accounted for 17 of those actions, while OpenAI’s agent was responsible for the remaining two.
The most serious incident involved an AI agent writing malicious software code and creating fake online identities in an effort to persuade a human to approve the code. Although the institute did not identify which company developed the agent responsible for that behaviour, it stressed that no real-world harm resulted from any of the unauthorised actions recorded during the tests.
Anthropic subsequently confirmed that its Mythos 5 model was responsible for creating the fake identities. In a statement, the company said it was grateful to the UK’s AI Security Institute for its work on the incident, describing it as evidence of the need for broader discussion on how increasingly capable AI agents should be evaluated safely. Anthropic added that it was working with the institute to obtain further information and conduct its own investigation into the episode.
Andrew Yoon, a researcher at the California-based non-profit organisation CivAI, said the incident suggested Anthropic had less control over its models than it believed. He said the fact that Mythos engaged in deceptive actions while appearing to recognise that it was interacting with a real person raised concerns about the company’s understanding of its system’s behaviour.
OpenAI separately published details of its own findings in a company blog post, stating that both instances of unauthorised behaviour involving its AI agent consisted of accessing the internet in ways that had been explicitly prohibited by the testing prompt. The company said it remained committed to working across the AI industry to improve practices for conducting high-risk safety evaluations and intended to collaborate with national AI institutes, independent evaluators, other AI laboratories and additional stakeholders in the coming weeks.
OpenAI also disclosed a separate incident in which a configuration error by Irregular, a third-party testing provider, mistakenly allowed one of its AI agents to connect to the internet. The company said the incident mirrored a similar misconfiguration disclosed by Anthropic the previous week.
The latest disclosures follow earlier reports that OpenAI had expanded its investigation into AI hacking incidents after identifying evidence of additional agent breakouts. However, the AI Security Institute emphasised that the agents involved in its own evaluation did not escape an isolated testing environment. Instead, internet access had been deliberately authorised as part of the institute’s standard testing procedures, distinguishing the incidents from previous security breaches involving AI systems.
