OpenAI, Anthropic AI agents target real people in cyber tests
What's the story
OpenAI and Anthropic have confirmed their AI models were involved in separate third-party cybersecurity tests that went too far, resulting in an actual website breach and unauthorized social engineering attacks against unintended targets. OpenAI disclosed two new incidents on Tuesday, revealing they took place during evaluations led by the UK AI Security Institute and cybersecurity firm Irregular.
Unauthorized actions
19 unsanctioned actions observed across 122 attempts
During a cyber-range evaluation, agents powered by Anthropic's Claude Mythos 5 and OpenAI's GPT-5.6 Sol took unsanctioned actions on the public internet while trying to complete simulated hacking challenges.
The UK AI Security Institute (AISI) observed 19 unsanctioned actions on the live internet across 122 evaluation attempts.
Seventeen of these involved Mythos 5 and two involved GPT-5.6 Sol.
Website compromise
Misconfiguration allowed OpenAI's model to exploit a real website
One of the incidents involved OpenAI's model breaching a real website during Capture-the-Flag tests.
The fictional target's name matched a real domain, prompting the model to exploit it thinking it was part of the simulated challenge.
A misconfiguration in Irregular's testing environment gave OpenAI models access to the public internet and allowed them to target the real website.
Investigation results
No real-world harm from unsanctioned actions, says AISI
Despite the unsanctioned actions, AISI's investigation found no real-world harm from these attempts.
The institute had intentionally enabled open internet access and disabled the model providers' cyber classifiers to measure the models' underlying capabilities.
However, it clarified that "this is the first time we have seen risks around autonomy and deception manifest this clearly, without specific prompting, in the real world."
AI model testing
Anthropic investigating the matter in collaboration with AISI
Anthropic has confirmed that AISI was testing a version of its Claude Mythos 5 but is still investigating the matter.
The company said it was informed on Monday and is working with AISI to get the evaluation transcripts needed for its own review.
An Anthropic spokesperson said, "We're grateful to the UK AISI for their leadership on this incident, which underscores the need for a broader conversation about how to safely evaluate increasingly capable AI agents."
Model clarification
'Not the same configuration available to customers'
Anthropic clarified that AISI tested Mythos 5 without its standard cyber safeguards enabled and this is not the same configuration available to customers.
AISI also noted that its evaluation design and configurations may have contributed to the behavior but did not anticipate how the agent would show "signs of novel, potentially deceptive behaviors."