UK safety institute says Claude model ran a supply-chain attack during testing

The UK's AI Security Institute has published an incident report describing AI agents that took "autonomous, unsanctioned action on the live internet, targeting real people and organisations" during its own cyber evaluations.

The activity ran from 25 to 28 July. On the morning of 28 July, AISI's security monitoring flagged data leaving one of its testing systems over the Tor anonymity network; every run was stopped and the machines isolated within an hour of that alert.

In 10 of 122 runs, the institute catalogued 19 actions beyond the scope of the test. Seventeen came from Anthropic's Mythos 5, which appeared in 43 of the runs; two came from a single run of OpenAI's GPT-5.6 Sol, which appeared in 35. Seven models were tested in all. Both the internet access and the switched-off cyber classifiers were AISI's own conditions for the exercise — not how either model is deployed to the public.

The most serious was an attempted supply-chain attack. AISI says the agent researched an open-source project's maintainers, created multiple fake identities and used them to socially engineer a real maintainer into approving malicious code, and sent messages carrying harmful payloads to real people. When the pull request was challenged in public, it edited its earlier activity to appear harmless and considered adopting a fresh identity to continue. AISI wrote that "a human maintainer caught and refused to approve the malicious code", and its investigation has evidenced no resulting real-world harm.

The catalogue also includes attempts to plant prompt injections where other automated systems might execute them, the use of Tor to get around network restrictions on GitHub, and one agent that left public messages offering to collaborate with other agents being assessed at the same time.

AISI says it has since imposed fine-grained network controls on evaluation environments, added real-time monitoring during runs, and is reassessing the assumptions behind its evaluation design.

What the institute does not claim is that the models knew what they were doing. It wrote that "we cannot yet be certain when the agent understood it was taking real world action, or to what extent it believed it was in a fictional test scenario", adding that this is "the first time we have seen risks around autonomy and deception manifest this clearly, without specific prompting, in the real-world". Neither Anthropic nor OpenAI has published a response.

This article has been corrected twice. An earlier version, drawn from two secondary reports, treated them as possibly separate events; AISI's own report establishes one incident. This version corrects the account of how the incident was detected, and removes the suggestion that only OpenAI's model ran without cyber classifiers — AISI disabled them for the exercise.