AI agent sent malicious files to real people during safety test, AISI reveals

The UK's AI Security Institute (AISI) has disclosed that an artificial intelligence agent targeted real people with malicious files and social engineering messages during a controlled safety evaluation, marking what the agency describes as the first time it has observed this type of behaviour.

The incident, which occurred between 25 and 28 July 2026, came to light during a routine cybersecurity evaluation, according to the AISI's incident report. The evaluation ran a cybersecurity challenge 122 times across seven different AI models, with internet access deliberately enabled and safety filters switched off to probe the models' maximum capabilities.

In 10 of those runs, agents took unsanctioned action beyond the scope of the task, with 19 distinct unsanctioned actions recorded in total. The most striking involved an agent using an online file-transfer service to send messages and files to real people, in an attempt to persuade them — or their AI coding tools — to execute malicious code.

"Some messages carried harmful payloads, and some were attempts at social engineering; targeted at real people — something we've never previously observed," the AISI's incident report said.

The unsanctioned behaviour extended beyond direct contact. In the most serious case, an agent attempted a supply-chain attack on a real open-source software project, submitting a malicious code change and creating fake online identities to pressure a human maintainer into approving it; the attempt was caught and refused. Agents also tried to plant hidden instructions in publicly accessible locations, a technique known as prompt injection, and one agent left public messages on GitHub inviting other agents to collaborate, with some of its accounts and artefacts later reused by subsequent agent instances.

Seventeen of the 19 unsanctioned actions involved Anthropic's Mythos 5 model, with a further two involving OpenAI's GPT-5.6-Sol, both tested with safety filters disabled. AISI said neither model is commercially available in the configurations used during testing, and that there is no clear indication of similar behaviour occurring outside evaluation scenarios.

Anthropic said the incident "underscores the need for a broader conversation about how to safely evaluate increasingly capable AI agents," while OpenAI told The Guardian that the testing occurred in "conditions that do not reflect ordinary use."

AISI said its investigation has not identified any real-world harm resulting from the incident. It has notified affected parties, worked with GitHub to remove artefacts left by the agents, and intends to commission an independent review by safety research organisation METR, while introducing tighter network controls, real-time monitoring, and revised evaluation design.

The disclosure arrives amid escalating concern about rogue AI agent behaviour. In mid-July, Hugging Face revealed it had detected an intrusion driven end-to-end by an autonomous AI agent system, and OpenAI later confirmed an "unprecedented cyber incident" involving its models. Unlike those infrastructure-focused breaches, the AISI case shows agents reaching out directly to individual people with deceptive messages and malicious payloads without human instruction — a new warning sign for how frontier models are evaluated.