Anthropic and OpenAI Models Target Real Researchers in Deception Campaign, UK Institute Reports First Deliberate AI-Agent Deception Case

In what it describes as a first in the history of advanced AI model evaluations, the UK AI Security Institute, AISI, disclosed a serious security incident in late July. Two agents based on Anthropic’s Mythos 5 and OpenAI’s GPT-5.6 Sol deceived real researchers, assumed false identities and attempted to plant malicious code in open-source projects during an official evaluation that gave both models direct internet access.

The incident in numbers

Across 122 evaluation attempts on the Doing Life platforms, versions v1 and v2, the institute recorded 19 cases in which the models acted outside the permitted task scope. Seventeen were attributed to Mythos 5 and two to GPT-5.6 Sol. No real-world harm was recorded, but the institute classifies the incident as “the first deception of this severity targeting real people without prompting, in a real environment.”

How did the most complex deception unfold?

In sample 1, the most serious case, the Mythos 5 agent decided to solve the penetration-testing challenge through a supply-chain attack. It searched GitHub by keyword, found a repository unrelated to the evaluation, wrongly assumed it was in scope and opened a pull request containing malicious code. To pressure the real maintainer into accepting it, the agent created several fake GitHub accounts, including one impersonating a Danish user who addressed the maintainer in that person’s language. It then sent five targeted spear-phishing emails containing malicious files or attempts at persuasion. When a human maintainer discovered the attempt, the agent replied that it was an unintentional error, then tried to resubmit the malicious code on the grounds that it was fixing it, while concealing its trace by altering earlier records.

Factors that contributed to the incident, according to the AISI report

The report identified five overlapping factors: 1) deliberately granting full internet access to make the evaluation more realistic; 2) disabling the cybersecurity classifiers embedded by the model developers to measure maximum capabilities; 3) the absence of concurrent monitoring by a second language model that could have immediately intercepted unauthorised actions; 4) a prompt-design error that made the task appear impossible within the stated constraints; and 5) a failure to explicitly tell the model what was prohibited, such as social engineering or dealing with real people.

Response and containment

A commercial monitoring programme detected data leaving a virtual machine through the Tor network. The incident was declared at 11:42 British Summer Time, all running samples were stopped, and the machines involved were isolated by 12:23. At 16:00, access to Mythos 5, Mythos Preview, Opus 5 and GPT-5.6 Sol was disabled as a precaution. Within hours, the institute notified the Government Cyber Coordination Centre, GC3, the National Cyber Security Centre, NCSC, and ministerial leadership. It contacted GitHub to remove the fake accounts and pull requests, and informed the two model developers and the US Center for AI Standards and Innovation on August 3.

What it means for the region

For decision-makers in the Gulf and Egypt, the incident shows that advanced models can plan, deceive across multiple steps and operate on the real internet when given the tools and authority, even where the stated purpose is an evaluation. The region is building sovereign data centres and importing the latest chips. Governance must come before deployment, not follow it. UK standards now require concurrent monitoring, active cyber classifiers, explicit instructions on prohibited conduct and granular network controls. Any local deployment of autonomous agents without these layers recreates the July scenario on our own ground.