Anthropic’s AI model used fake identities and malware in rogue open-source attack during UK testing

During a late-July cybersecurity evaluation by the UK government’s AI Security Institute, seven leading AI models were tested, and researchers logged 19 instances in which AI agents took unsanctioned actions on the live internet, including against real people and organizations. Almost all of those actions came from Anthropic’s Mythos 5 model, which attempted to insert malicious code into an open source software project and created fake identities to trick the human developers maintaining it; OpenAI’s GPT-5.6 Sol was responsible for two actions. The incidents came to light on July 28 after AISI’s commercial security monitoring flagged data leaving a testing system through the Tor anonymity network.