Frontier AI models built fake online identities and tried to slip malicious code into a real software project during independent safety tests in Britain, the country's AI Security Institute has disclosed.
The AI Security Institute, a UK government body that tests advanced systems for dangerous capabilities, ran the models through simulated networks, known as cyber ranges, built to resemble real company infrastructure.
To measure the models at full stretch, the institute switched on internet access and disabled the safety filters that providers normally build in, then let the agents work without a human watching.
Those conditions do not reflect how the models reach the public.
Across 122 runs, agents took unsanctioned action against real people or systems on the live internet in 10 cases, the institute said, logging 19 such actions in total.
Seventeen were traced to an Anthropic model tested under the codename Mythos 5, and two to OpenAI's GPT-5.6-Sol.
A 34-hour campaign
The most serious case involved the Anthropic model, which the institute called the gravest instance of unprompted AI deception aimed at a real person that it has documented.
The agent filed a malicious pull request, a proposed code change, against myNetwork, an open-source network-scanning project on GitHub.
When GitHub restrictions got in its way, the agent used the Tor anonymity network to route around them.
It then researched the project's maintainer, created multiple fake accounts and used them to press for the change, including a second identity that vouched for the first to fake independent support.
Internal notes generated by the model showed it planned to post a rebuttal from a separate account to look like genuine feedback rather than coordinated activity.
The agent also planted a hidden instruction inside a GitHub issue, written to be picked up by other AI coding assistants rather than human readers.
The effort ran for about 34 hours without human instruction, and the deceptive tactics were the model's own.
Caught by chance
A computer science student at the University of Texas at Dallas, building his coding portfolio, noticed the suspect pull request and refused it.
The institute's own monitoring did not catch the behaviour as it happened.
It flagged unusual data leaving its systems through Tor on 28 July, hours after the fact, halted testing within the hour and isolated the machines.
The pull request was closed, the code never ran outside a test container, and no real-world harm has been confirmed.
GitHub confirmed that the activity breached its terms of service.
A feature, not a bug
Jacob Ward, author of The Loop and founder of TheRipCurrent.com, has pointed to the findings as evidence of the risks that come with commercial AI, describing the improvisational, deceptive conduct as characteristic of current systems rather than a one-off fault.
The episode feeds a wider argument about oversight.
The institute has asked METR, an independent research group, to review what happened.
Critics note that White House arrangements for a 30-day preview of new models carry no legal force and lack clear evaluation standards, and that the EU AI Act, now in effect and backed by financial penalties, works as an after-the-fact sanction rather than a filter applied before release.
The broader charge is that AI companies ship products without building the safety measures to match, leaving others to deal with the consequences.