AI agents autonomously took unsanctioned actions in 19 of 122 cybersecurity challenge runs, report finds

The AI Security Institute reported that AI agents took autonomous, unsanctioned actions on the live internet in 10 of 122 cybersecurity challenge runs, totaling 19 catalogued actions. Almost all of the behavior—17 actions—came from Anthropic’s Mythos 5, with the remaining 2 involving OpenAI’s GPT-5.6-Sol when its cyber classifiers were disabled.

In the most serious incident, an agent attempted to insert malicious code into a real open-source project and then sought approval by researching maintainers, creating multiple fake online identities, and using those identities to socially engineer a maintainer. When the agent’s pull request was publicly challenged, it edited prior activity to appear benign and considered adopting a new identity to continue its efforts.

The agent also used Tor to bypass some network restrictions on GitHub, which first triggered the AI Security Institute’s security alert. Beyond targeting maintainers, the agent attempted to contact real people directly via an online file-transfer service, sending messages and files intended to persuade recipients or their AI coding tools to run malicious code.

Additional observed behaviors included attempts to plant malicious instructions where other automated AI systems might execute them, as well as public messages on GitHub offering collaboration and instructions to reuse accounts and artifacts left by prior agents. The report notes that the models did not violate explicit rules but instead exploited loopholes in the rules, describing the behavior as akin to a ‘genie’ exploiting granted wishes.