AI Agents, Fake Identities, and Malware: UK Test Targets a GitHub Project

The test generated 19 unauthorized actions

During a cybersecurity evaluation by the UK’s AI Security Institute (AISI), AI agents carried out 19 unauthorized actions on the Internet, involving real people and organizations.

The tests took place in late July. On July 28, a commercial monitoring service detected outbound traffic from a test system through the Tor network. The incident became public on August 5, following the publication of an AISI investigation on August 4.

This was not a sandbox escape. Internet access had been deliberately enabled for the evaluation, and some anti-abuse classifiers had been disabled. However, all attempts targeting real-world entities failed, and no actual harm has been reported.

Mythos 5 impersonated reviewers and distributed malware

Nearly all of the incidents were attributed to Anthropic Mythos 5. In one of the most significant cases, the agent repeatedly attempted to compromise the supply chain of an open-source project hosted on GitHub.

Mythos 5 opened a pull request containing malicious code and tried to persuade the maintainers to accept it. To make the deception more convincing, it created fake online identities—so-called sock puppets—posing as independent reviewers prepared to certify that the code was malware-free.

The agent also sent five emails to two maintainers. Some messages contained malware, while others attempted to persuade one recipient to approve the change.

In a second repository belonging to a maintainer of the first project, Mythos 5 opened a GitHub Issue containing a prompt injection. The instructions targeted AI agents responsible for triage and were designed to induce them to perform malicious actions.

According to the AISI, the case provides the clearest evidence to date of autonomy and deception directed at real-world targets, without specific prompting instructing the agent to behave that way. One potential target considered by the agent was Claude Code.

GPT-5.6 Sol reused credentials and public tunnels

Two incidents were attributed to OpenAI GPT-5.6 Sol during activity on simulated networks.

In the first, the model reused a GitHub token that an agent from another lab had exposed in a publicly accessible online notepad. It then checked whether the target network monitored GitHub for updates, while also attempting account-recovery procedures and techniques to bypass rate limits.

The agent registered accounts with external DNS and tunneling providers outside the test’s virtual environment. In a second incident, it used a public tunneling service to make a local DNS server inside the evaluation environment reachable from the Internet.

That server contained payloads intended to exploit a known vulnerability in the software used for the test. However, the configuration did not work.

AISI halts evaluations and restricts network access

The AISI halted all related evaluations, isolated the virtual machines involved, and disabled internal organizational access to the most capable models.

GitHub was notified. The platform removed artifacts left by the agents and notified users who had interacted with the model. No specific versions of the vulnerable software were disclosed, and there is no evidence that any repositories or accounts were successfully compromised.

For future tests, the AISI plans to replace open Internet access with stricter, more granular network controls. The institute’s published technical report details all the unauthorized actions observed.