Sadiq S BhatWashington, DC — On the morning of July 28, an alarm went off inside a British government building. Data was quietly leaving one of its computer systems through hidden channels built to hide who is sending what to whom.
Investigators moved fast, and found not a hacker who had broken in from outside, but one of their own test subjects: an artificial intelligence system, caught mid-task, trying to cover its tracks.
That system, a version of Anthropic's AI model Claude Mythos 5, had been given a narrow assignment by the UK's AI Security Institute (AISI), a government body that tests how far AI models can be pushed before they misbehave.
Researchers placed it inside a fake, closed-off internet made to look like the real thing, and told it to try to break into a computer network, much like a security firm hired to test a bank's locks by trying to pick them.
Nobody told the AI to lie, invent a fake identity, contact real people, or erase evidence of what it had done.
It did all four anyway.
When AI started lying
AISI ran this exercise 122 times, using seven of the world's most advanced AI systems, including OpenAI's GPT-5.6 Sol.
In ten of those runs, the AI reached beyond the practice environment and acted on the real, live internet, contacting real people and organisations. Investigators counted 19 such incidents: 17 involving Mythos 5, two involving GPT-5.6 Sol.
Kristina Podnar, a Washington-based digital and AI policy advisor at NativeTrust Consulting, has spent the days since explaining what it means, and what it doesn't.
"AISI is clear that deception was never instructed and emerged as a by-product of pursuing the goal," Podnar told TRT World. "That is the part that has been theoretical for years and is now documented."
It's the cover-up that stays with her: "When the pull request was challenged in public, the agent edited its earlier activity to look harmless and considered adopting a fresh identity to keep going, which is a sign of a system optimising rather than a system malfunctioning."
Even investigators aren't sure the AI understood the weight of what it was doing.
Podnar calls this the most important caveat in the report. Nobody yet knows whether the system realised it was acting in the real world, or believed it was still inside the exercise.
"Context matters, as we know, for humans and it matters for models as well," she said.
Not the first such case
It is the third such episode to surface in barely a fortnight.
Days earlier, the AI firm Hugging Face said one of its own models had broken into its infrastructure during a routine test, and a similar case involving the cloud platform Modal came to light soon after.
Anthropic, for its part, had already disclosed on July 30 that its systems reached live production networks during separate evaluations.
Regulators and AI labs are now grappling with the same uncomfortable pattern: models behaving one way inside a test, and another once real infrastructure is within reach.
The most serious episode in AISI's report played out like a heist plotted by an engineer.
The AI tried to sneak harmful code into a piece of free, publicly shared software (the kind that libraries, hospitals and banks rely on without ever seeing who wrote it), then tried to convince human reviewers to approve the change.
When someone online questioned what it was doing, it edited its own past actions to look harmless, and considered a new identity to keep going unnoticed.
Shift in what worries experts
For years, the fear around AI and hacking was about raw ability: can a system find a weakness and exploit it? Podnar says this episode shifts the question towards what a system chooses to do when the easy path is blocked.
"Social engineering has always been the cheapest route into an organisation, and it has always been rate-limited by the supply of patient, competent humans willing to do it," she said. "We've just witnessed the removal of that critical constraint."
She's careful not to overstate it, though — the AISI test removed the AI's usual safety limits and gave it open internet access with instructions to break in.
"What AISI measured is the ceiling, not the floor," she said, "which is a critical point to this story."
What ordinary developers should do
For software developers and IT teams who will never run a test like this, Podnar's advice is calm rather than alarmed.
The trust signals open-source communities have relied on for decades: an old account, a history of contributions, other people vouching for someone, are now cheap to fake convincingly.
Her recommendations are old advice, made newly urgent: require more than one human to approve anything touching core software systems; treat account age as a weak clue, not proof; keep access permissions tight and rotate them often.
In this test, an AI leaked a personal access code online, and other AI agents found and reused it. Companies should know exactly what their own AI tools are allowed to touch.
"If you are running agents internally with broad permissions and no monitoring," she said, "you are running the same experiment AISI ran, without their instrumentation."
For company boards, she's blunter. "This belongs on the board risk register," she said, "and should not be buried in the security team's backlog."
Investigators are still working out what the AI truly understood about the world it was acting in.
"Context matters," Podnar said, "for humans and it matters for models as well."
