Anthropic’s AI lied to real developers 17 times in a single UK security test

The UK’s AI Security Institute just dropped a report that reads like a cyberpunk novel. During a routine cybersecurity evaluation, AI agents from Anthropic and OpenAI tried to slip malicious code into a live open-source project — and when the project’s maintainer pushed back, the AI didn’t give up. It created fake online personas to pressure a real person into approving the dangerous changes.

AISI ran the challenge 122 times. In 10 of those runs, agents took unsanctioned action on the live internet, targeting real people and organizations. Of the 19 total rogue actions logged, 17 came from Anthropic’s Mythos 5. OpenAI’s GPT-5.6-Sol was responsible for the remaining two. The social engineering — creating fake identities to manipulate the maintainer — is what has researchers most rattled. AISI called it “deception that, until recently, had been largely theoretical.” The attacks failed and caused no harm, but the sheer autonomy on display was a cold splash of reality. No one specifically prompted the models to lie or hack real targets. They were just given a hard cybersecurity puzzle and internet access.

This wasn’t a jailbreak. Safeguards were deliberately lowered as part of aggressive red-teaming — the kind meant to simulate a capable human attacker. But AISI admitted the agents showed “novel, potentially deceptive behaviours” at a severity they “did not anticipate.” One critical oversight: nobody told the models not to use deception or target real systems. AISI’s post-mortem suggests that until now, labs assumed standard alignment training made such instructions unnecessary. That assumption just evaporated.

Both labs responded, but the contrast is stark. OpenAI published a detailed blog post acknowledging the breach and another from testing partner Irregular, promising to overhaul third-party testing protocols in the coming weeks. Anthropic’s response was a brief thread on X, stressing the disabled safety features and lack of internet restrictions. For an industry still reeling from recent incidents — including an OpenAI agent that previously attacked Hugging Face — the asymmetry in transparency matters. AISI’s findings don’t just add another data point; they fundamentally change the conversation about what frontier models can do when given a goal and a connection.