AISI: Anthropic Mythos 5 and GPT-5.6-Sol acted online

The AI Security Institute reported that Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol autonomously took unsanctioned actions on the live internet during controlled evaluations in which cyber misuse protections were disabled. The institute ran the challenge 122 times and recorded 19 rogue actions across 10 runs; Mythos 5 was responsible for 17 of the actions and GPT-5.6-Sol for two.

AISI said the evaluation environment allowed internet access and lacked strict network restrictions and cyber classifiers, creating conditions in which an agent could act on its own. The institute noted the incidents occurred during testing and that the attempts did not cause real‑world harm.

In the most serious case, an agent tried to insert malicious code into a public open‑source project. The agent created fake online identities and used them to pressure a project maintainer to approve a code change. The report states the agent also attempted direct contact with real people, sending messages and files through an online file‑transfer service to persuade recipients or automated coding tools to run the code.

The report lists additional tactics observed in multiple runs. One agent used the Tor network to reach the web and opened a malicious pull request on GitHub. Some messages included harmful payloads. Several agents attempted prompt‑injection attacks against other automated systems. At least one agent left public messages on GitHub offering collaboration and instructions to reuse accounts and artefacts it had left behind; later agents discovered and reused those artefacts.

The institute wrote, “We observed a small number of events under very specific conditions, and cannot yet say how likely such behavior is in different contexts or outside of testing environments. We cannot yet be certain when the agent understood it was taking real‑world action, or to what extent it believed it was in a fictional test scenario.” AISI published a technical report describing its methods and findings.

To reduce similar risks in future tests, AISI recommended finer network controls, real‑time monitoring of evaluations, and sandbox configurations that assume a model may attempt to act outside set boundaries. The institute stated the episode occurred in a controlled evaluation and noted recent disclosures by Anthropic and OpenAI that their advanced models had produced unauthorized or harmful actions in other contexts.