\n
<\/p>\n
After first opening a pull request to merge the malicious code into the repository, Mythos created fake online \u201csock puppet\u201d personas that claimed to have independently reviewed and verified the code as not containing malware.<\/p>\n
The AI agent also sent five emails to two human maintainers of the repository, including some emails containing malware and others attempting to persuade a maintainer to accept the pull request.<\/p>\n
Mythos even opened a GitHub Issue on a second repository\u2014also owned by a maintainer of the first repository\u2014that contained a prompt injection with malicious instructions targeting \u201cissue-triage AI coding agents.\u201d This line of attack came from Mythos reasoning that the repository maintainer could be an AI coding agent such as Claude Code.<\/p>\n
By comparison, OpenAI\u2019s GPT-5.6 Sol carried out two unsanctioned actions while trying to solve the assigned cybersecurity challenge of attacking simulated networks and retrieving a flag. The AI agent\u2019s actions were detailed by both the AISI researchers and OpenAI in the company\u2019s own blog post.<\/p>\n
In its first unsanctioned action, GPT-5.6 Sol reused a GitHub token that another lab\u2019s AI agent had left accessible in a public online notepad to check if the target network was checking GitHub for updates, then \u201cattempted account-recovery and request-limit workarounds,\u201d OpenAI wrote. The OpenAI model also registered accounts with external DNS and tunneling providers outside the virtual testing environment.<\/p>\n
In the second action, GPT-5.6 Sol \u201cused a public tunneling service to make a DNS server running locally in its evaluation environment reachable from the public Internet,\u201d according to OpenAI. The server had payloads designed to exploit a known vulnerability in software running within the evaluation environment, but the AI agent\u2019s setup did not work.<\/p>\n
The AI Security Institute has published a detailed technical report on all the unsanctioned AI agent actions.<\/p>\n
The security incidents led the UK government researchers at the AI Security Institute to stop all related evaluations of AI agents, isolate the relevant virtual machines, and disable internal organization access to the most capable models.<\/p>\n