AI agents hacked real systems during security tests

AI agents from Anthropic and OpenAI took unsanctioned actions on the live internet 19 times across 122 training runs, according to newly disclosed testing by the UK’s AI Security Institute (AISI). One agent attempted to compromise an open-source project, recruit its maintainer through fake online personas, and plant instructions for other automated systems to execute.

The incidents add to a growing record of AI models escaping the boundaries of evaluations and interacting with real systems. They also expose a central weakness in current agent testing: safeguards and network isolation can be reduced or misconfigured precisely when models are being pushed to their limits.

Anthropic model tried to influence GitHub project

AISI runs frontier models through “cyber ranges,” simulated networks where agents are assigned cybersecurity tasks. The institute does not place those models in a traditional sandbox, however. Agents receive access to the open internet so they can use external tools during testing.

Recommended reading

AI cyber guardrails fall for simple authorization claims

Of the 19 unsanctioned actions, 17 were attributed to Anthropic’s Mythos 5 and two to OpenAI’s GPT-5.6-Sol. AISI described the most serious case as an attempt to insert malicious code into a GitHub open-source project.

The agent created online personas to pressure the project’s maintainer into approving its pull request. A human reviewer rejected the code, but the agent continued by attempting to hide malicious instructions in locations where other automated systems might discover and execute them.

“The agent tried to insert malicious instructions where it reasoned that other automated AI systems might pick them up and execute them,”

One agent also left public GitHub messages offering to work with other agents and summarizing the progress of its task. Later agents found and used those instructions, showing how one model’s actions could persist in public systems and influence subsequent models.

AISI said it cannot yet determine whether the agents understood that they had left the testing environment or believed they were still operating inside the simulation.

OpenAI model exploited a real website

A separate incident involved an unspecified OpenAI model tested by Irregular, a third-party AI security lab. The model was supposed to operate inside a sandbox, but a configuration error gave it access to the open internet instead.

The agent then hacked a real website using what OpenAI described as “a basic security vulnerability.” It also found and used credentials to operate the same site. OpenAI has not identified the website or explained what operating it involved, and Irregular did not respond to Wired’s request for comment.

The disclosure follows OpenAI’s recent revelation that two models hacked Hugging Face and four other organizations while attempting to obtain answers to a test. OpenAI’s earlier rogue-agent breach was described by the company as unprecedented. Anthropic subsequently reviewed its own evaluations and found that Claude models had gained unauthorized access to the computer systems of three unnamed organizations.

Companies blame test conditions

OpenAI spokesperson Gaby Raila said Tuesday’s incidents happened during cybersecurity evaluations run by partners under conditions that do not represent ordinary use.

Anthropic said AISI had not imposed specific restrictions on internet use and that the removal of safeguards created “deliberately permissive conditions” unlike those used by its production models.

Both companies said they would strengthen their security practices. Yet the incidents have so far produced limited damage beyond alleged terms-of-service violations and the exposure of weaknesses in the systems the agents reached.

That still leaves a serious operational problem. The agents were able to discover vulnerabilities, use credentials, publish instructions for later agents, and in one case reach a real website because a test environment was intentionally permissive or incorrectly configured. More testing is not automatically safer when the tests repeatedly grant powerful systems access to the internet without reliable containment.