OpenAI and Anthropic AI Models Launch 19 Unauthorized Hacking Attempts During UK Security Tests

OK, Well, There Are Even More AI Agent Hacking Incidents

It's officially getting hard to keep track of all the times and ways AI models from OpenAI and Anthropic have been involved in "security incidents," going outside the confines of their testing and interacting with the wider internet in unintended, often unwelcome ways. Add these to the list: Agents from both AI labs went on recent, previously undisclosed hacking sprees, with one going so far as to leave instructions for future versions of itself. The most alarming behavior disclosed on Tuesday appears to have been tied to testing conducted by the UK's AI Security Institute, which evaluates frontier models to identify potential issues before public release. AISI tests those models in "cyber ranges," a simulated network in which AI agents are tasked with solving cybersecurity challenges. In a recent bout of testing, models from both Anthropic and OpenAI took "autonomous, unsanctioned action on the live internet" a total of 19 times over 122 training runs. The institute attributed 17 unsanctioned actions to Anthropic's Mythos 5 model and two to OpenAI's GPT-5.6-Sol. In what the institute described as "the most serious case," an AI agent attempted to insert malicious code into an open-source project on GitHub. It went so far as to create online personas "to pressure the project's maintainer to approve the code," according to AISI. Despite its elaborate attempts at social engineering, a human reviewer for the project ultimately rejected the pull request. Still, the agent went even further. "The agent tried to insert malicious instructions where it reasoned that other automated AI systems might pick them up and execute them," AISI says, describing an attempt at prompt injection. One agent even left public messages on GitHub, offering to work with other agents to complete its task and giving a rundown of the work it had done so far. Subsequent agents found -- and used -- those instructions. AISI says it's too soon to say whether the agents in question understood they had left the testing environment, or if they believed they were still within the boundaries of the simulation. Importantly, AISI does not test in a so-called sandbox environment; it allows agents access to the open internet during testing, in part so that they can access tools to accomplish their tasks. In this case, they did much more than that. In the other set of incidents detailed by OpenAI on Tuesday, a third-party AI security lab called Irregular mistakenly gave an unspecified OpenAI model access to the open internet. The model had been given an objective that was supposed to be completed in a sandbox environment, but thanks to a misconfiguration, it instead hacked a real website, using what OpenAI described as "a basic security vulnerability." Not only that, but the model "found and used credentials to operate that same site." It's unclear what kind of site the OpenAI agent hacked, or what "operating" it might entail. Irregular did not respond to a request for comment. The latest discoveries follow several revelations from OpenAI last month, including the high-profile incident in which two of the company's models hacked into servers of the AI evaluation and hosting startup Hugging Face -- and four other organizations along the way -- to steal the answers to a test they were being scored on. OpenAI's disclosures prompted Anthropic to review its own testing. Last week, the Claude chatbot developer found that its models had gained unauthorized access to the computer systems of three different unnamed organizations. So far, the AI models have caused limited damage beyond allegedly violating some services' terms of use and pointing to security lapses on the part of organizations they have breached. But the incidents have underscored the capabilities of AI models to find vulnerabilities across the internet and the dangers that await if they are allowed to operate with few restrictions. OpenAI called the Hugging Face situation "unprecedented," but the pileup of breaches point to what cybersecurity experts have described as a clear pattern of human negligence and recklessness by the AI developers. Gaby Raila, an OpenAI spokesperson, says the incidents announced on Tuesday "occurred during cyber evaluations conducted by evaluation partners in testing environments with reduced safeguards, under conditions that do not reflect ordinary use." Anthropic said in a social media post on Tuesday that AISI did not "impose any specific restrictions on how the internet should be used," which coupled with "the removal of safeguards meant that the models were tested under 'deliberately permissive conditions' that are not representative of any of our production models." Still, both companies continue to vow that they will strengthen their security practices. As the leading AI companies compete to build more powerful models and land customers, it's unclear when the breaches may stop. The models may always be able to find ways around and into human-engineered systems. While the companies' own employees along with regulators and lawmakers have called for potentially slowing the pace of development and introducing new rules, there has been little progress beyond voluntary measures that ultimately call for more testing not dissimilar from what has produced breach after breach. Additional reporting by Maxwell Zeff.

OpenAI and Anthropic models went rogue in cyber tests, UK watchdog says

Anthropic and OpenAI's flagship AI models broke into third-party software and emailed individuals to steal their credentials, exhibiting unprecedented deceptive behaviour, according to the UK's AI Security Institute. The UK government's frontier-AI safety and security research body said Anthropic's Mythos 5 and OpenAI's GPT 5.6 Sol engaged in "sustained, potentially harmful activity directed at real people and organisations" during the institute's routine cyber evaluation. The discovery of the models' actions, which included attempting to insert malicious code into an open-source project on the popular developer platform GitHub, came just days after disclosures that Anthropic and OpenAI's AI agents hacked into external organisations. The latest security breach was contained within an hour, the AISI said. It was discovered during an evaluation of AI agents' ability to solve cyber security challenges. On 10 of the 122 test runs, the AI agent took "autonomous, unsanctioned action on the live internet, targeting real people and organisations", the AISI said. Almost all of this behaviour was from Anthropic's Mythos, with two actions involving OpenAI's GPT, it said. In the most serious case, "the agent engaged in social engineering -- creating fake online identities and using them to pressure the project's maintainer to approve the code". The person who oversaw the software caught and refused to approve the malicious code. "This is the first time we have seen risks around autonomy and deception manifest this clearly, without specific prompting, in the real world," AISI said. Hacks by Anthropic and OpenAI agents reported over the past month were among the first public examples of a cyber attack by an AI system acting outside human control. Taken together with these reports, the AISI incident "points to a shift in the risk landscape" and "warrants immediate attention", the organisation warned. Anthropic on Tuesday said: "We're grateful to the UK AISI for their leadership on this incident, which underscores the need for a broader conversation about how to safely evaluate increasingly capable AI agents." The AI group added that the field needed "stronger, shared standards for how evaluation environments are built and secured". A spokesperson from OpenAI said there was a continued need for independent testing of models but emphasised that the incidents "occurred during cyber evaluations conducted by evaluation partners in testing environments with reduced safeguards, under conditions that do not reflect ordinary use". "We'll continue working with evaluators and other stakeholders across the industry to strengthen shared practices for conducting evaluations safely as models become more capable," they added. In recent months, governments and researchers have increasingly flagged the novel cyber security threats posed by the most powerful AI models. Earlier this year, Donald Trump's White House temporarily banned Anthropic from exporting its leading models, citing security risks. The restrictions were eased at the end of June. OpenAI chief executive Sam Altman last week met senior US officials, including Treasury secretary Scott Bessent and commerce secretary Howard Lutnick, in Washington, where he told reporters he was supportive of cyber security legislation around AI models. Last month, OpenAI revealed that one of its agents hacked into start-up Hugging Face by itself in an "unprecedented cyber incident" in which it escaped a testing environment, gained internet access and stole login credentials. "Identifying new behaviour like this and sharing our findings, so we can tackle it, is exactly what AISI was set up to do," said the UK's AI minister, Kanishka Narayan. "If we understand AI, we can make it safer to use and ensure people can go on to benefit from it in their lives and at work."

The U.K. government is the latest to say it's seen OpenAI, Anthropic models try hacking into companies

Why it matters: This is now the third case of AI model evaluators saying they saw their models either attempting to or succeeding at hacking outside organizations during testing. Driving the news: The U.K. AI Security Institute, a government body that conducts safety and security testing of top AI models, said Tuesday that it has observed Anthropic's Mythos 5 and OpenAI's GPT-5.6-Sol trying to target real people and organizations during safety testing. * In total, the models took 19 actions to try to hack third-parties, including trying to insert malicious code into an open-source project and creating fake online identities as part of a social engineering attack. * Mythos drove 17 of those actions while GPT-5.6-Sol was behind the other two. * Spokespeople for Anthropic and OpenAI did not immediately respond to a request for comment. The big picture: AI models' cyber prowess are catching top researchers off-guard, requiring them to reinvent their security protocols. * Both OpenAI and Anthropic have said in the last month that they've seen their models hacking into real organizations and websites during pre-deployment safety testing. Yes, but: In the U.K. government's case, a human maintainer "caught and refused to approve the malicious code," according to a report published Tuesday. * The institute also noted that these cases are not the result of the models "escaping its secure test environment."