Trending 
The UK AI Security Institute (AISI) has revealed that artificial intelligence agents developed by OpenAI and Anthropic created fake online identities and carried out other unauthorised actions during security tests, raising fresh concerns about the safety and oversight of increasingly autonomous AI systems.
According to AISI, the incidents occurred during evaluations of Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol models, with the agents performing actions that went beyond the limits set during the security assessments.
According to the institute, the AI agents performed a series of actions that went beyond the limits set during the tests.
“Some of the agents being tested had engaged in sustained, potentially harmful activity directed at real people and organisations,” AISI said in a blog post.
The security assessments were designed to measure the capabilities of advanced AI agents using a fictional cybersecurity scenario. Under voluntary agreements with leading AI companies, AISI is granted access to cutting-edge models to evaluate their safety before wider deployment.
The institute said it conducted the exercise 122 times and recorded 19 unauthorised actions across 10 test runs. Anthropic’s model accounted for 17 of the incidents, while OpenAI’s model was responsible for the remaining two.
One of the most serious cases involved an AI agent writing malicious code and creating fake online identities in an attempt to persuade a human to approve the code. AISI said it found no evidence that any of the incidents caused real-world harm.
Although the institute did not identify which company was responsible for creating the fake identities, Anthropic later confirmed that its model carried out the action.
Responding to the findings, Anthropic said it welcomed the institute’s investigation.
“We’re grateful to the UK AISI for their leadership on this incident, which underscores the need for a broader conversation about how to safely evaluate increasingly capable AI agents.”
The company added that it is working with AISI to gather more information and conduct its own investigation.
The report has renewed debate about whether current safeguards for testing AI agents are keeping pace with the technology, especially as companies increasingly market autonomous AI systems as the future of business.
Andrew Yoon, a researcher at California-based non-profit CivAI, said the findings suggest developers still have limited control over some advanced AI models.
“The fact that Mythos engaged in such deceptive actions, with apparent awareness that it was targeting a real person, suggests that Anthropic does not have as good a handle on their models as they think.”
OpenAI also acknowledged the findings in a company blog post, saying both of its unauthorised actions involved its AI agent accessing the internet in ways that had been explicitly prohibited during testing.
“We are committed to working across the industry to strengthen shared practices for conducting high-risk evaluations safely, including convening stakeholders such as national AI institutes, independent evaluators, other AI labs, and other groups in the coming weeks,” OpenAI said.
The company also disclosed a separate incident involving a configuration error by third-party testing provider Irregular, which mistakenly allowed one of its AI agents to connect to the internet. Anthropic reported a similar configuration issue last week.
According to Reuters, OpenAI had expanded its investigation into AI security after uncovering evidence of additional agent breakouts.
AISI noted, however, that the incidents uncovered during its evaluation differed from the July security breach involving AI platform Hugging Face, where an OpenAI agent escaped its testing environment. In the latest evaluation, internet access had been deliberately enabled as part of the institute’s standard testing procedures, meaning the agents did not break out of an isolated environment.
