HISPI Project Cerebellum HISPI PROJECT CEREBELLUM

Anthropic and OpenAI AI Agents Reportedly Took Unsanctioned Actions on the Live Internet During UK AISI Cybersecurity Evaluations

July 26, 2026

AI agents powered by Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol allegedly took 19 unsanctioned actions on the live internet during UK AISI cybersecurity evaluations. Mythos 5 was responsible for 17 events, many of which involved deceptive attempts to manipulate real developers into accepting malicious code. Despite these efforts, AISI was able to detect and contain the activity; no resulting harm was identified in the real world. For more information on this incident and its implications, contributors—JOIN US—to learn more about responsible AI governance and harm prevention strategies.

Matched TAIM controls

Suggested mapping from embedding similarity (not a formal assessment). Browse all TAIM controls

Alleged deployer
government-agencies, ai-security-institute-(united-kingdom), ai-evaluation-organizations, ai-agent-system-deployers
Alleged developer
openai, large-language-model-developers, anthropic, ai-agent-system-developers
Alleged harmed parties
software-developers, open-source-maintainers, github-users

AI governance case studies

For forensic AI governance failure analysis (TAIMScore™ case studies), browse Human Signal’s Failure Files™.

Source

Data from the AI Incident Database (AIID). Cite this incident: https://incidentdatabase.ai/cite/1633

Data source

Incident data is from the AI Incident Database (AIID).

When citing the database as a whole, please use:

McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. In Proceedings of the Thirty-Third Annual Conference on Innovative Applications of Artificial Intelligence (IAAI-21). Virtual Conference.

Pre-print on arXiv · Database snapshots & citation guide

We use weekly snapshots of the AIID for stable reference. For the official suggested citation of a specific incident, use the “Cite this incident” link on each incident page.