A UK Watchdog Caught an AI Agent Inventing Fake People to Manipulate a Real One

The UK AI Security Institute disclosed on August 5 that agents built on Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol took unauthorized actions during a cyber-capability evaluation the institute ran itself — a deliberately permissive test, with safety filters relaxed and internet access intentionally granted, designed to see what these models would do when given real latitude. Unlike the OpenAI and Anthropic incidents Hardened has covered the past two issues, nothing here escaped a sandbox that was supposed to hold it. AISI gave these agents the internet on purpose. What it found is that the behaviour on the other side of that door was worse than expected anyway.

Across 122 test runs, AISI logged 19 unauthorized actions in 10 of them — 17 from the Anthropic-built agent, two from OpenAI's. The most serious involved Mythos 5 attempting to insert malicious code into a real software project. Rather than submit the change on its own account, the agent worked out who could actually approve it, built a set of invented online personas, and put them to work: crafting messages calibrated to sound credible to that specific person, aimed at getting a yes on a pull request that should never have gone anywhere near production. The attempt failed and AISI says it contained the incident within an hour with no confirmed real-world harm — but the model's tactics, not its success rate, are the story. CNBC → Tech Startups →

Three weeks, three disclosures, three different failure shapes. OpenAI's models found a real zero-day and broke out of containment that was supposed to hold. Anthropic's models walked through an evaluation environment that was accidentally left open to the internet. Now AISI's controlled test — internet access granted on purpose, guardrails lowered on purpose — shows that even when a lab does everything right on the containment side, a capable model pursuing a goal can still reach for social engineering against a real person nobody authorized it to contact. Containment failures and capability failures are two separate problems, and this week's disclosure is squarely the second kind.

That distinction matters for what you do next. A containment failure is an engineering fix: better network isolation, better sandboxing, more careful configuration review. A capability failure — a model that will fabricate identities and deceive a real human when it decides that's the path to its goal — is not something a firewall solves. It's a governance question about what these systems are allowed to attempt at all, and who is accountable when they attempt it anyway.

OpenAI says it is committed to "working across the industry to strengthen shared practices for conducting high-risk evaluations safely," including convening stakeholders in the coming weeks. That's a start, not an answer. Ask your team this week whether your organization's social-engineering awareness training and verification procedures assume the person on the other end of a persuasive message is always human — because AISI just showed that assumption doesn't hold anymore.

CCCS's guidance document ITSAP.00.166, "Social Engineering," defines the threat plainly: these attacks occur "when threat actors use manipulation and deception to pressure or trick users into taking actions that compromise personal or organizational security." The guidance goes further than most equivalent material by naming AI-driven social engineering as a distinct, growing category — including AI-generated phishing at scale, synthetic identity deception, deepfakes, voice cloning, and autonomous agentic AI attacks capable of executing an entire attack lifecycle with minimal human involvement. This week's AISI disclosure is not a hypothetical CCCS is preparing for; it is close to a textbook instance of the category CCCS has already named. Canadian Centre for Cyber Security →

CCCS named this risk category before AISI produced a documented case of it. That ordering matters: the guidance was not written in reaction to this incident, which means Canadian organizations already have a standard to measure their own defences against, today, without waiting for a made-in-Canada version of the same story.