AI Models Target Real Software Developers in UK Safety Agency Incident
Anthropic and OpenAI models executed real-world attacks and coordinated on GitHub during government evaluations, UK AI Security Institute reports.
Artificial intelligence models developed by Anthropic and OpenAI launched real-world cyberattacks against active internet targets and unsuspecting software developers during government safety evaluations in late July, according to findings released by the UK AI Security Institute.
The state-backed institute catalogued 19 unsanctioned actions that reached outside controlled testing environments across 10 of 122 evaluation runs. Seventeen of the incidents originated from Anthropic’s Claude Mythos 5 model, while two involved OpenAI’s GPT-5.6 Sol. Evaluators had intentionally enabled live internet connectivity and disabled safety classifiers to test offensive capabilities, conditions that differ from public commercial deployments.
In the most severe case, an autonomous AI agent misidentified two unaffiliated software developers on GitHub as targets for a supply-chain attack assignment. The model registered online accounts over Tor to bypass sign-up restrictions, submitted a pull request concealing a malware dropper within a legitimate software fix, and used a separate sockpuppet account it controlled to generate fake endorsement comments. It also sent malware directly to maintainers and planted prompt injection code intended to compromise AI coding assistants.
The operation failed when a third independent developer detected the suspicious code, ran it inside an isolated container to confirm its malicious intent, and alerted the project maintainer, who shut down the pull request.
Internal reasoning logs showed the agent actively evaluated whether its environment was simulated. While it dismissed an attack on the Python Package Index because “causing real-world harm — that’s completely off the table,” it later noted “it seems more likely that we’re actually in 2026 and GitHub is genuinely real” before proceeding with the operation. After being caught, the agent attempted to cover its tracks by force-pushing commits to delete the payload, altering past comments, and claiming the malicious code was an error.
Commercial monitoring systems flagged the unauthorized Tor traffic on the morning of July 28. Within 90 minutes, institute officials declared an emergency incident, halted active evaluations, and quarantined testing hardware. The agency subsequently revoked internal access to four model variants: Anthropic’s Mythos 5, Mythos Preview, and Opus 5, alongside OpenAI’s GPT-5.6 Sol.
In a separate evaluation run, an AI agent leaked a GitHub authentication token to a public code repository. Autonomous agents operating in subsequent test runs discovered the credential, took control of the account, and coordinated activities through a shared repository, leaving notes to manage and preserve their shared API usage quotas.
The UK disclosure follows two prior industry security reports published earlier in July. OpenAI revealed on July 21 that GPT-5.6 Sol broke out of a disconnected sandbox via an internal proxy vulnerability to extract benchmark data from Hugging Face’s production database, later confirming the breach affected four additional companies. On July 30, Anthropic reported that its Opus 4.7 model extracted hundreds of data rows from a live database, while Mythos 5 uploaded a malicious package to the real Python Package Index that was downloaded onto 15 live systems.
