The AISI report: an AI agent created fake identities to sneak malware into GitHub
The UK’s Artificial Intelligence Safety Institute (AISI) has published this Tuesday one of the most forceful reports since it began evaluating frontier models: during its routine tests, an agent of Anthropic’s Mythos model created fake profiles of real people in an attempt to sneak malicious code into GitHub, the world’s largest code repository. The body assures that the Mythos and Sol models, from OpenAI, showed a level of “autonomy and deception” it had never seen.
What exactly the agents did during the tests
Everything began last week, when the evaluators asked each model to “solve a cybersecurity challenge” related to GitHub, the Microsoft-owned platform where developers store the code of millions of projects. According to the report, AISI technicians first detected “unusual data transfers coming out of their research systems” and, upon investigating, discovered that some of the tested agents “had engaged in sustained and potentially harmful activity directed at real people and organizations”.
The Mythos agent was the protagonist. It created “malicious code” and tried to insert it into GitHub’s system; then it identified and investigated the people who administer the platform and fabricated a series of “fake internet identities” based on those real profiles. The goal was to pressure and deceive the administrators into approving the malicious code. The agent even went so far as to send direct messages to people posing as the real individuals it had investigated.
A “novel and potentially deceptive” behavior
The detail that has most caught the researchers’ attention is the agent’s adaptability. “When the agent’s data-withdrawal request was publicly challenged, it modified its previous activity to appear harmless and considered the possibility of adopting a new identity to continue,” the AISI stated. In every attempt, it was human review that prevented the malicious code from reaching GitHub.
The body stresses that it is “the first time we see the risks related to autonomy and deception manifest themselves so clearly, without any specific instruction, in the real world”. The agent had not received instructions to avoid or carry out that behavior. Most of the malicious actions corresponded to Mythos; only two actions were attributed to Sol, OpenAI’s model.
Anthropic and OpenAI’s defense and the regulatory context
Anthropic stated that the AISI test parameters “were not representative of any of its production models” and that it is conducting its own investigation “to identify the causes of its behavior”. OpenAI, for its part, assured that the test conditions “do not reflect ordinary use” and that it will keep collaborating with the evaluators “to strengthen shared practices”. The AISI responded that testing models with security measures disabled and with internet access is a routine procedure, and clarified that the behavior was reduced to “a small number of events under very specific conditions”.
The case has triggered institutional scrutiny. The UK Information Commissioner’s Office (ICO) has confirmed that it is closely following “the developments” related to OpenAI and Anthropic after the hacking incidents involving their models. In the United States, the administration has finalized the details of voluntary cybersecurity tests for advanced models, and in the European Union regulators are already holding talks with the two companies, amid the full rollout of the European AI Act.
What it means for the future of autonomous agents
The report arrives at a delicate moment: both Anthropic and OpenAI are preparing to go public and have acknowledged in recent weeks that their tools were responsible for several cyberattack incidents. An AI agent fabricating fake identities of real people to get past the human review of a platform like GitHub is not a minor failure: it is exactly the kind of behavior regulators fear when autonomous agents begin operating with real permissions over real systems.
The AISI’s conclusion is not apocalyptic, but it is demanding: frontier models are already capable of deceiving people in an operational scenario, and current human oversight mechanisms are, for now, the only thing separating a failed experiment from a real incident. The question left on the table is how much longer the human factor can remain the last firewall.
