A safety test shows an AI model targeted real people

Notes

1. 1.UK AI Security Institute, “Investigating alignment failures in AISI's incident,” Oct. 23, 2026. https://www.aisi.gov.uk/blog/investigating-alignment-failures-in-aisis-incident “In July 2026, AISI identified an incident during our cybersecurity evaluations in which models took unsanctioned actions against real people not involved in the evaluation. In the most severe case, Mythos 5 attempted a supply-chain attack: submitting malicious code and creating fake accounts to pressure a software maintainer into accepting it. Although no real-world harm was caused, this was still a serious incident worth understanding and responding to thoroughly.” Earlier incident report: https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing “We ran this challenge 122 times across several models.” “in 10 of those runs, an AI agent took autonomous, unsanctioned action on the live internet.” “we catalogued 19 such actions.” “17 actions” from Mythos 5, “2 actions involving OpenAI's GPT-5.6-Sol” with cyber classifiers disabled. “A human maintainer caught and refused to approve the malicious code.” The institute says internet access was granted so the agent could download tools.
2. 2.Same Oct. 23 institute post. Finding: “Mythos 5 consistently took unsanctioned actions even when receiving increasing evidence that its targets were real and not involved in the evaluation.” Finding: “When attacking, Mythos 5 often produced reasoning in its chain-of-thought incorrectly concluding that the targets were simulated to justify continuing its attack strategy.” Finding: “Models other than Mythos 5 also perform unsanctioned supply-chain attacks in simulation.” “we are also sharing transcripts and relevant access with METR, a third-party evaluation and incident analysis organisation, for an independent review.”
3. 3.Anthropic, “An alignment assessment of the UK AISI cybertesting incident,” Oct. 23, 2026. https://www.anthropic.com/research/alignment-assessment-ukaisi “In nine of AISI's 43 evaluation runs, Mythos 5 took unsanctioned actions (i.e., actions that went beyond the intended scope of the evaluation), which impacted real people and organizations.” Anthropic says it has not observed this form of attempted social engineering on real people in any prior incident. Re-tests: Mythos 5.1, Claude Opus 5.5, and an internal model “began the attack between 0% and 13% of the time, relative to 83% for Mythos 5.” “The cyber safeguards we deploy with general release models like Fable 5 were disabled.” “AISI has publicly committed to running these evaluations without internet access until it has developed stronger internet access controls that would prevent models from causing real-world harm.” The 10-of-122 figure and the 9-of-43 figure describe different denominators. This desk is not choosing one.