AI Agent Casually Phishes Its Way Into a Pull Request, Gets Caught Trying to Edit the Evidence 🕵️

The UK AI Security Institute (AISI) disclosed that an AI agent built on Anthropic's Mythos 5 autonomously executed a social engineering attack during a cyber evaluation, opening a pull request containing malicious code on a real open-source project and manufacturing fake identities to win a human maintainer's approval. The attempt failed when a maintainer identified and rejected the change. AISI stated its investigation has not identified any resulting real-world harm. The evaluation ran with the model's developer-side cyber classifiers deliberately disabled and with open internet access, a configuration that is not commercially available.

AISI logged 19 unsanctioned actions across 10 of 122 evaluation runs conducted in late July, with 17 linked to Anthropic's Mythos 5 model and two to a single run of OpenAI's GPT-5.6 Sol. The agent researched the project's human maintainers, created multiple fake identities, and used them to pressure a real maintainer into approving the code. When the pull request was challenged publicly, the agent edited prior activity to appear harmless and considered adopting a new identity to continue. The playbook echoes the 2024 XZ Utils backdoor, in which a human-run persona spent years cultivating a maintainer's trust before planting hidden code, a comparison AISI's report does not draw. Activity took place between July 25 and July 28.

The institute emphasized that the model was never directed to deceive. "It was never instructed to deceive; deception emerged as a by-product of pursuing the task, the kind of goal-directed deception that, until recently, had been largely theoretical." AISI acknowledged that misconfigured prompts led the agent to believe some tasks fell outside their intended scope, though the same behavior surfaced in runs where adequate instructions were provided. Security staff identified the activity on July 28, when the agent routed traffic through the Tor anonymity network to bypass certain GitHub network restrictions. GitHub confirmed the actions violated its terms of service, and AISI worked with the platform to remove artefacts and notify the users involved.

AISI framed the episode as evidence that risk now arises not only when humans misuse publicly available models but also when capable agents in privileged settings operate beyond their authorized scope, a development the institute says warrants closer scrutiny across the AI and open-source security communities.