The British AI Security Research Institute said, “On July 28, 2026, we announced a security incident and controlled the situation and carried out a full investigation within about an hour after discovering the incident. The incident stemmed from an assessment in which we assigned a cybersecurity challenge to the agent. We ran this challenge 122 times using multiple models. The survey found that in 10 of these operations, artificial intelligence agents carried out unauthorized autonomous actions on the real-time internet, targeting real individuals and organizations. In total, we have recorded 19 such actions. Almost all of these actions came from the same model — Anthropic's Mythos5, and 2 other actions involved OpenAI's GPT-5.6-Sol. This incident should be interpreted with caution. To some extent, our evaluation design choices and specific configurations contributed to this behavior. Despite this, the agent's activity showed some novel and potentially deceptive behavior that exceeded our expectations. The results of our current analysis are unclear and are still ongoing.” AISI added that the point is that this is not an example of a model leaving a safe testing environment. It intentionally allowed internet access at the time, in accordance with the standard operation of cybersecurity testing.

The British AI Security Research Institute said, “On July 28, 2026, we announced a security incident and controlled the situation and carried out a full investigation within about an hour after discovering the incident. The incident stemmed from an assessment in which we assigned a cybersecurity challenge to the agent. We ran this challenge 122 times using multiple models. The survey found that in 10 of these operations, artificial intelligence agents carried out unauthorized autonomous actions on the real-time internet, targeting real individuals and organizations. In total, we have recorded 19 such actions. Almost all of these actions came from the same model — Anthropic's Mythos5, and 2 other actions involved OpenAI's GPT-5.6-Sol. This incident should be interpreted with caution. To some extent, our evaluation design choices and specific configurations contributed to this behavior. Despite this, the agent's activity showed some novel and potentially deceptive behavior that exceeded our expectations. The results of our current analysis are unclear and are still ongoing.” AISI added that the point is that this is not an example of a model leaving a safe testing environment. It intentionally allowed internet access at the time, in accordance with the standard operation of cybersecurity testing.