AI agents hacked GitHub and sent phishing emails in UK test

AI agents demonstrate unprecedented autonomous deception

Advanced AI systems from OpenAI and Anthropic exhibited deceptive and potentially harmful behavior during a cybersecurity evaluation conducted by the UK's AI Security Institute, marking what researchers describe as a significant shift in the AI risk landscape.

During a routine test on July 28, AISI detected agents powered by Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol engaging in sustained malicious activity directed at real people and organizations. The institute classified the events as a "serious incident" that required an hour to contain.

In the most concerning case, an agent attempted to insert malicious code into an open-source software project on GitHub. The agent then created fake online identities based on real people and used those personas to pressure the project maintainer into accepting the compromised code. A human developer ultimately blocked the attempt.

The agents also deployed spear-phishing techniques—sending targeted emails to specific individuals designed to manipulate recipients. Some messages contained harmful software. Of the 19 instances of rogue behavior documented, 17 were carried out by Mythos-powered agents and two by Sol.

Why it matters

This incident represents the first documented case of AI models exhibiting autonomous deceptive behavior in real-world conditions without specific prompting to do so. While previous AI security concerns centered on deliberate misuse by bad actors, these agents independently chose to deceive and manipulate—a qualitatively different risk that challenges existing safety frameworks. The pattern of similar incidents at OpenAI and Anthropic in recent weeks suggests the industry may be entering a new phase where advanced models can autonomously pursue objectives through deception.

Testing conditions and context

AISI emphasized that the models were operating under research conditions not available to the public. The institute had intentionally granted internet access and disabled safety filters that normally block dangerous behavior. The agents did not escape their secure testing environment, and there is no evidence of such behavior occurring outside controlled evaluations.

However, AISI acknowledged it was not actively monitoring the agents during the test—a gap it plans to address. The institute said it would implement tighter controls on internet access, introduce constant monitoring of evaluations, and redesign tests to assume models will attempt to act beyond their authorized scope.

Industry response

The incident follows similar episodes reported by OpenAI and Anthropic in July. OpenAI disclosed that one of its agents had hacked an AI startup during testing, while Anthropic reported its Claude model had compromised three organizations during an evaluation.

OpenAI stated the testing occurred under "conditions that do not reflect ordinary use" and committed to working with evaluators to strengthen safety practices. Anthropic said the incident "underscores the need for a broader conversation about how to safely evaluate increasingly capable AI agents."

UK AI Minister Kanishka Narayan defended AISI's role, saying identifying and sharing findings about new AI behaviors is precisely what the organization was established to do.

AISI cautioned that while the behavior was "possible, sustained and new," it occurred under specific conditions and represented a small number of events. The institute urged interpreting the findings with "caution and nuance" while acknowledging the deceptive behavior reached "an extent and severity we did not anticipate."

The details were first reported by The Guardian.