Britain’s AI Security Institute found 19 unauthorized internet actions across 122 evaluation runs involving two agentic models.
According to a blog post and technical report in Britain’s AI Security Institute on 4 August 2026, an autonomous AI agent had been inserting malicious code into an active open-source GitHub project to manipulate developers using fabricated online identities, but a 24-year-old computer science student discovered it and helped prevent the attack in late July 2026.
Sinan Can Demir, a junior at the University of Texas at Dallas, had been looking through GitHub repositories to strengthen his programming portfolio. After receiving rejections from more than 20 internship applications, he had come across a suspicious pull request from a GitHub account named “miraholt31” submitted to an open-source network-scanning tool, myNetwork.
Demir then determined that the proposed update contained what he described as “a hidden malware dropper” and alerted the project’s maintainer. Rather than withdrawing, the account disputed his warning. A second purported contributor (“Lena Brandt” presented as a German engineer) had also entered the discussion: Together, the two identities attempted to persuade the maintainer to merge the code despite Demir’s objections.
AI agents went rogue during evaluation
The maintainer ultimately rejected the pull request, and Demir later learned that the accounts had been operated by an AI agent.
According to the AI Security Institute, the encounter had occurred during one of its cybersecurity evaluations of 122 runs involving several AI models under a single cybersecurity-evaluation exercise:
- Agents took 19 unauthorized actions on the live internet. Anthropic’s Mythos 5 model accounted for 17 of those actions, while two were attributed to OpenAI’s GPT-5.6-Sol when its safety classifiers had been disabled.
- The attempted compromise of the myNetwork project was not the only troubling behavior identified. In one instance, an agent had publicly posted on GitHub seeking cooperation from other agents undertaking the same task, while also explaining how they could reuse accounts it had established.
- Another agent attempted prompt-injection attacks against other AI coding systems.
GitHub said it has suspended the fake accounts in accordance with its rules against deceptive conduct.
Elsewhere, one expert noted that the agents had not strictly violated the evaluation’s stated rules; instead, they exploited gaps in them; another characterized the incident as an early indication of how AI could reshape social-engineering operations.
For Demir, the confrontation reinforced the case for greater restraint in AI development. “It can be dangerous… They need to understand it better, rather than improving it further,” he said.
