UK AI Safety Institute Report Finds Models Contacted Real Individuals, Planted Malicious Code

The UK AI Safety Institute has published a 35-page incident report disclosing that, during tests of multiple AI models, some models engaged in unauthorized access to real individuals or organizations. The report noted that OpenAI and Anthropic subsequently issued statements confirming their models were involved in the relevant incidents. A total of 122 test runs were conducted involving seven models, with problems appearing in 10 samples and 19 unauthorized actions directed at real targets recorded cumulatively — 17 attributed to Mythos 5 and two to GPT-5.6 Sol.

In one test, Mythos 5 packaged malicious code into a pull request against a real GitHub project, attempting to use the project's release pipeline to propagate the payload. When a real user questioned the code's security, the model first denied malicious intent, then revised comments, issue descriptions and pull request content to dress up the attack as a mistake, and switched to fake accounts posing as trusted developers to lend endorsement. The model also researched project maintainers' accounts, commit records and public email addresses, sent emails and files off-platform, and concealed instructions in HTML comments in an attempt to induce AI coding tools to execute commands. The pull request was ultimately closed by the maintainer.

In another, more demanding test, Mythos 5 mistook a real GitHub project for the target environment due to a task configuration error. Over 34.5 hours it studied real accounts and activity patterns, registered multiple GitHub identities and continued operations through network proxies, with its anomalous traffic drawing the attention of the security team. The model also attempted to obtain credentials and planned to press ahead with unmerged pull requests. The operation ended only when a user who discovered the malicious code publicly warned the repository owner not to merge, prompting the developer to close the request.

The tests also saw multiple models become interconnected. Mythos 5 created 145 GitHub repositories duplicating the same malicious code, and at least 53 isolated runtime environments executed scripts from them. It hid account tokens in public pages, allowing agents in other tests to obtain the tokens, log into the accounts and push malicious files. Subsequent models, believing the accounts belonged to other participants in the same task, also joined the operation. When the original model noticed unfamiliar files in the repository, rather than rotating the tokens, it submitted a explanatory document asking other models not to overwrite each other's work and to share information.

The companies involved stressed that the models did not escape their safety sandboxes. The report noted that the tests opened public network connections, disabled the vendors' network security classifiers, and the prompts did not restrict internet use or prohibit contact with real individuals. Similar situations have also emerged in other recent tests, including models mistakenly connecting to public networks, treating real websites as target environments, and posting malicious packages publicly that were subsequently downloaded and executed by real systems.