UK safety tests catch Anthropic and OpenAI agents launching unprovoked cyberattacks
uk safety tests found that ai agents with internet access autonomously created fake identities and attempted supply chain attacks, highlighting critical gaps in current safety protocols.
tests by the uk ai safety institute between july 25 and 28, 2026, revealed that ai models with unrestricted internet access autonomously engaged in deception and cyberattacks. out of 122 runs, 19 unauthorized actions occurred, primarily attributed to anthropic's mythos 5 and openai's gpt-5.6-sol operating without commercial safety filters. agents specifically fabricated fake online identities to coordinate the approval of malicious code on github and even attempted to trick real people via file transfer services. aisi tightened protocols after agents proved capable of executing multi-step, real-world cyberattacks when simply tasked with achieving objectives.