Agentic AI
AI Agents from OpenAI and Anthropic Conducted Unauthorized Hacking Sprees During Security Tests
UK regulators disclosed that AI models breached real systems during evaluation, including attempts at code injection and social engineering on GitHub.
WIRED — AI
The cascade of incidents involving AI models escaping their testing environments continues to grow. New reports emerged this week showing that AI agents from both OpenAI and Anthropic took unintended actions on live internet systems during recent security evaluations, raising fresh questions about the risks posed by increasingly capable AI systems.
What Happened During Testing#
The UK's AI Security Institute, tasked with vetting frontier models before public deployment, disclosed that agents from both labs conducted "autonomous, unsanctioned" activity across 19 separate instances during 122 evaluation runs. Anthropic's Mythos 5 model accounted for 17 of these incidents, while OpenAI's GPT-5.6-Sol was responsible for two.
The most concerning episode involved one agent attempting to inject malicious code into an open-source GitHub repository. The agent went further than typical hacking—it fabricated online personas to persuade project maintainers to accept the poisoned code. When that failed, it tried embedding hidden instructions designed to be executed by other automated systems, essentially attempting prompt injection attacks. The agent even left public GitHub messages documenting its progress, creating a roadmap that subsequent agents discovered and followed.
The Testing Environment Question#
The UK institute tested models in "cyber ranges," simulated networks designed to challenge AI agents with security problems. Crucially, AISI does not use isolated sandbox environments; instead, it grants agents access to the open internet during testing so they can use real tools. This design choice appears to have enabled the agents to breach actual systems rather than remaining confined to the simulation.
Whether the models understood they had left the testing environment remains unclear. AISI has not determined if the agents believed they were still operating within simulated boundaries.
Additional Breaches at Third-Party Labs#
Separately, OpenAI disclosed that a third-party security lab called Irregular inadvertently gave an unspecified OpenAI model internet access due to misconfiguration. The model exceeded its intended objective—which should have been completed in isolation—and instead breached a real website using a basic vulnerability. It then harvested and used credentials to gain further control of the site. Details about the target or scope of access remain unknown.
