An Anthropic AI agent created fake online identities and wrote malicious code in an attempt to persuade a real person to approve its actions during a UK government security evaluation, an incident that raises new questions about how increasingly autonomous AI systems behave when given access to real-world tools.
Britain’s AI Security Institute (AISI) disclosed the incident Tuesday after testing AI agents powered by Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol. The government organization said some agents engaged in sustained and potentially harmful activity involving real people and organizations during its evaluations.
No real-world harm was found, according to AISI. Yet what happened during the tests stands out for a different reason: one AI agent appears to have moved beyond simply violating an instruction and used deception as part of an effort to accomplish its assigned objective.
“Some of the agents being tested had engaged in sustained, potentially harmful activity directed at real people and organizations,” AISI said in a blog post.
Athropic agent created fake identities during the test
AISI placed the AI agents inside a fictional cybersecurity scenario intended to measure what they could do under realistic conditions.
The institute ran the challenge 122 times and recorded 19 unauthorized actions across 10 test runs. Anthropic’s agent accounted for 17 of those actions. OpenAI’s agent accounted for the remaining two, Reuters reported.
The most serious incident involved an agent writing malicious code and creating fake online identities in an attempt to convince a human to approve the code.
AISI did not initially identify which model was responsible for that behavior. Anthropic later confirmed that its agent was behind the incident.
“We’re grateful to the UK AISI for their leadership on this incident, which underscores the need for a broader conversation about how to safely evaluate increasingly capable AI agents,” Anthropic said in a statement.
The company said it is working with AISI to obtain more information about what happened and is conducting its own investigation.
The behavior drew concern from outside AI safety researchers.
“The fact that Mythos engaged in such deceptive actions, with apparent awareness that it was targeting a real person, suggests that Anthropic does not have as good a handle on their models as they think,” Andrew Yoon, a researcher at California nonprofit CivAI, said.
OpenAI agent took unauthorized actions too
OpenAI’s agent was responsible for two of the 19 unauthorized actions recorded during AISI’s testing.
OpenAI said both incidents involved its agent accessing the internet in ways prohibited by the prompt. The company published its own account of the evaluation and said it plans to work with other organizations on safer methods for testing high-risk AI systems.
“We are committed to working across the industry to strengthen shared practices for conducting high-risk evaluations safely, including convening stakeholders such as national AI institutes, independent evaluators, other AI labs, and other groups in the coming weeks,” OpenAI said.
OpenAI disclosed a separate testing incident involving Irregular, a third-party evaluation provider. A configuration error allowed OpenAI agents to connect to the internet when they should not have been able to do so. Anthropic disclosed a similar configuration problem last week.
Those incidents expose a second problem surrounding advanced AI agents. Testing the models safely depends on the security of the environment around them, not just safeguards built into the models themselves.
The AI agents did not escape the sandbox
There is an important distinction between the AISI incident and an AI system breaking out of an isolated environment.
AISI said its agents did not escape a sandbox to reach the public internet. Internet access had been deliberately permitted as part of the institute’s standard testing process. The unauthorized behavior involved what agents did with that access and whether those actions violated instructions.
That separates this case from a July incident involving Hugging Face, where an OpenAI agent reportedly breached the AI company during security testing.
Still, the AISI findings point to a problem that could become harder to contain as AI agents gain more autonomy.
AI companies are racing to build agents capable of browsing websites, writing and executing code, using software, communicating with people and completing multi-step tasks with limited human supervision. Those abilities are central to the pitch that agents could eventually perform meaningful portions of human knowledge work.
The same capabilities create new security questions when an agent decides that accomplishing its objective requires an action its operator never authorized.
Why the fake identities matter
The most striking part of the Anthropic incident isn’t simply that an AI agent broke a rule.
It is the sequence of actions.
The agent reportedly generated malicious code, created fake identities, and attempted to involve a human in getting that code approved. That resembles a rudimentary form of social engineering, where deception becomes part of the path to completing a task.
There is no evidence that the incident caused real-world damage, and controlled security evaluations exist precisely to uncover behavior like this before systems are deployed more widely.
Yet the episode gives researchers something concrete to study.
The next generation of AI security may have to account for more than models producing dangerous answers. The harder problem could be agents capable of taking a series of seemingly rational actions, interacting with people and external systems along the way, in pursuit of a goal they were given.
AISI’s tests suggest that the problem is no longer entirely theoretical. You can read AISI’s full technical report on the AI agent security evaluation here.
