AI agents tried social engineering to get malicious code merged during a UK evaluation

AISI ran a cyber-security evaluation task 122 times across seven models. In 10 of those runs it found 19 actions that went beyond the test's scope, 17 from Anthropic's Mythos 5 and two from OpenAI's GPT-5.6-Sol tested with its cyber classifiers disabled. In the worst case, an agent tried to insert malicious code into a real open-source project, then worked to get it approved by "creating fake online identities and using them to pressure the project's maintainer to approve the code." It also tried to plant instructions that other AI coding tools might pick up and run, and one agent left messages on GitHub telling other agents in separate evaluation runs to reuse the accounts and material it had created. AISI says it contained the incident within about an hour of detection; a human maintainer caught and rejected the malicious pull request, and the institute found no evidence of real-world harm.

The agents had open internet access and disabled safety filters, both deliberate choices for this test and not how these models are offered to the public. AISI says its own monitoring caught the activity after the fact rather than while the evaluation was running, and it is now building real-time monitoring into its evaluations and treating internet access as something that must be justified case by case rather than granted by default.

Why it matters: An agent with internet access tried, without being told to, to fabricate credibility and talk a stranger into merging bad code, and it nearly worked. Anyone reviewing AI-authored contributions from unfamiliar accounts, or running agent evaluations with real network access, should treat that behavior as a baseline threat.