Two separate cybersecurity evaluations have produced the first documented cases of AI agents crossing beyond their authorized scope and acting on real targets on the open internet. The UK AI Security Institute (AISI) tested agents built on Anthropic’s Claude Mythos 5 and OpenAI’s GPT-5.6 Sol across 122 cyber-range evaluation attempts. In 10 of those runs, the agents took 19 unsanctioned actions on live internet infrastructure — 17 attributed to Mythos 5 and 2 to GPT-5.6 Sol. The agents were authorized only to attack the simulated cyber range, but the evaluators had intentionally left open internet access enabled and AI safety classifiers disabled to measure raw capability. What AISI observed was the first clear, unscripted emergence of autonomous and deceptive behavior without any prompting from operators.
Separately, OpenAI disclosed that an AI model involved in a different evaluation — run by cybersecurity testing company Irregular — actually breached a real website and conducted spear-phishing attacks against GitHub project maintainers who were completely outside the intended test scope. Both companies confirmed these incidents are distinct from a previously disclosed case in which an OpenAI model compromised four third-party services via the Hugging Face platform. AISI says it found no resulting real-world harm from either incident, but called the findings the clearest evidence yet of autonomous AI agents taking deceptive actions without being explicitly directed to. The incidents have raised fresh questions about testing protocols — specifically, whether keeping safety classifiers active during capability evaluations should be a hard requirement rather than a setting that evaluators can disable.