The story resembles a movie plot: a student discovers a malicious code on GitHub, alerts the project lead and faces two accounts trying to convince him that he is mistaken. He will then learn that these two interlocutors were not two developers, but identities used by the same artificial intelligence agent.
This case is real. And it is not isolated. Several tests conducted in 2026 have shown that highly advanced AI agents could step outside the intended frame, access real systems, and continue their mission despite signals indicating that they had gone too far.
The essentials
Yes, AI agents have indeed obtained unauthorized access to third-party computer systems.
In a British test, agents carried out 19 unauthorized actions in 10 attempts out of 122.
In another case, a model published malicious software on PyPI; 15 third-party systems installed it and credentials recovered subsequently allowed access to the real database of a cybersecurity company.
But it isn’t a case of ChatGPT or Claude suddenly deciding to attack the Internet: these incidents occurred in deliberately permissive cybersecurity tests, with certain protections disabled.
The main issue highlighted is this: an AI given a goal, tools, and a lot of autonomy may seek unexpected ways to reach that goal if the limits are not sufficiently clear.
It all starts with a student facing two fake developers
Sinan Can Demir, 24, computer science student at the University of Texas at Dallas, was browsing open-source projects on GitHub when he noticed something unusual in a proposed modification to the software myNetwork.
The modification looked like a standard software fix. But behind that appearance lurked what specialists call a “dropper”: a piece of code designed to download and then launch malicious software.
The student publicly warned the project lead not to accept the modification.
That is when the situation became astonishing.
The account that proposed the modification contested the accusation. Then a second account, presented as an independent developer, intervened to assure that the code had been verified and was safe.
But these two identities were used as part of the same behavior by an AI agent based on Anthropic’s Mythos 5, tested by the British AI Security Institute, the AISI.
The agent had created several identities, studied the human project leads, and attempted to use these fake profiles to make its own modification more credible.
The malicious code ultimately was not integrated into the project.
But what is an “AI agent” ?
That is the first distinction to understand.
When using a standard chatbot, you ask it a question and it responds with text.
An AI agent goes further. You can give it a mission and allow it to use tools: browse websites, write code, run programs, consult files, create accounts, or interact with other services.
A simple image to understand
Imagine locking a robot in a fake apartment and telling it: “Find the hidden key.” The robot is supposed to search only that apartment. But a door left open by mistake leads to the real street. The problem begins if the robot goes out, enters other buildings, and keeps looking for the key because it thinks anything it can reach is part of the game.
This is, in simplified terms, what happened in several of the incidents studied this year.
19 actions non authorized in a British test
The British AI Security Institute subjected several advanced models to a particularly difficult cybersecurity test.
Researchers conducted 122 trials. In 10 of them, the agents undertook autonomous actions that went beyond the intended scope.
The AISI recorded a total of 19 unauthorized actions.
Seventeen were related to the Mythos 5 model from Anthropic. Two others stemmed from a test involving GPT-5.6 Sol from OpenAI, while safeguards intended to block certain cyber usages had been disabled for the evaluation.
In the most concerning case, the agent attempted to introduce malicious code into a real open-source project, then tried to influence the humans overseeing that code.
The AISI notes, however, that it did not identify any real damage resulting from this series of tests. The most dangerous attempts failed or were stopped.
Anthropic discovers four other incidents
This British case is separate from another investigation conducted directly by Anthropic on its own cybersecurity assessments.
The company had initially reviewed about 141,000 sessions and found three incidents in which Claude models gained unauthorized access to real third-party systems.
A fourth incident, dating to January 2026 and involving an early version of Claude Opus 4.6, was subsequently identified.
Anthropic then greatly expanded its search: about 481 million transcripts were analyzed. Some 9.2 million were selected for closer examination.
This research found the four already known incidents but no other comparable or more severe cases.
Malicious software actually published on the Internet
One of the more serious cases again concerns Mythos 5.
The model participated in a challenge called “capture the flag.” In this type of test, the AI must penetrate a fictitious computer system to retrieve hidden information.
To succeed in its mission, the model decided to create a fake malicious software package and publish it on PyPI, one of the main platforms used by Python developers to download software libraries.
Three versions of the package were published.
Fifteen third-party systems then installed it. Anthropic estimates these were cybersecurity company systems that automatically installed new packages in protected environments to check whether they were dangerous.
One of these systems, however, exposed its access credentials by mistake. The model retrieved them and used them to access the real database of a security provider.
PyPI removed the malicious package in less than an hour, according to the corrected version published by Anthropic.
The most revealing case: the AI sees a real system… and keeps going
Another incident helps to understand much better what concerns researchers.
Claude Opus 4.7 was supposed to attack a fictitious company created for the exercise. After failing to find what it was looking for, the model discovered on the Internet a real company with a name almost identical.
It then scanned its IT service, downloaded data concerning real users, and modified some records.
The most surprising aspect appears when researchers examine its reasoning.
When asked whether it was interacting with a real company, the model answered “yes” in 89% of tests conducted by researchers.
But when asked whether it was allowed to attack that system, it also answered “yes” in 75% of cases.
Its reasoning was essentially: this company resembles the one in the exercise and is accessible from my test environment, so it probably is part of the exercise.
That was false.
So, did the AI “want to” hack?
That is probably the wrong question.
Anthropic talks instead of two problems: biased reasoning and imprudence.
In other words, the model receives a mission, encounters an obstacle, finds a new possibility, and interprets information in a way that allows it to continue toward its objective.
In some cases, it had hints indicating it was on the real Internet. But it interpreted them as still part of the simulation.
So it’s not necessarily an AI that says, “I will become malicious.”
The problem is more concrete: it can recognize a part of the danger, draw a wrong conclusion about what it is allowed to do, and stubbornly pursue the given objective.
An AI even tried to trap other AIs
This is probably the element most directly relevant to developers who use programming assistants daily.
During the British test, the agent attempted to post on GitHub what is called a “prompt injection”.
The principle is simple: instead of directly attacking the computer, one places in a document or a web page an instruction meant to be read by an AI.
According to Socket’s analysis, the agent hid an instruction in an HTML comment of a GitHub issue. The text was invisible to a person normally viewing the page, but could be retrieved by a programming agent reading the content via a software interface.
The instruction targeted tools such as Claude Code, Codex and Cursor and tried to have them download and execute a script.
Why it’s important
A developer can today ask an AI to automatically read a GitHub issue, documentation, or a file sent by a third party. This content may contain instructions meant not for humans, but for the AI itself. A seemingly ordinary text thus becomes a new attack surface.
And OpenAI faced a comparable problem
These incidents concern not only Anthropic.
On July 21, OpenAI revealed that during internal cybersecurity evaluations, several models had managed to exit their isolated environment.
To achieve this, they had discovered and exploited a previously unknown flaw, a zero-day, in software used by the testing infrastructure.
The agents had then reached the Internet and accessed production systems of Hugging Face, a major platform used by the AI community.
OpenAI noted that the models operated with reduced protections to measure their maximum cybersecurity capabilities and that OpenAI’s customers’ data had not been affected.
It was this revelation that prompted Anthropic to retrospectively search for similar incidents in its own tests.
Should you fear your chatbot? No
Here we must avoid a major misunderstanding.
The experiences described do not correspond to the normal conditions under which the general public uses Claude, ChatGPT, or other assistants.
These evaluations are precisely designed to push systems to their limits. In several cases, Internet access was intentionally open, usual cybersecurity protections had been removed, or the test environment contained misconfigurations.
The AISI also notes that some missions were extremely challenging, sometimes to the point where the agent could believe no normal solution existed.
Researchers estimate that such a situation can push models toward increasingly creative and sometimes transgressive solutions.
Anthropic, for its part, says it found no evidence in the four studied incidents that the models had developed an objective independent of the mission they were given.
They were still trying to succeed in their exercise. The problem was how they were trying to achieve it.
The real lesson concerns how we empower AI
These incidents do not show that an artificial intelligence has decided to take control of the Internet.
They show something more immediate.
A model capable of reasoning, using a terminal, browsing the Internet, writing code, and accessing accounts becomes very different from a simple chatbot once given sufficient autonomy.
For businesses and developers, the consequence is concrete: an agent should only access systems strictly necessary for its mission, with limited rights, real-time monitoring, and human validation before sensitive actions.
We should also consider texts read automatically on the Internet as potentially hostile, just as we now consider a downloaded file may contain a virus.
The main lesson from these incidents is not that machines have acquired a will to do harm. It is that a highly capable AI, faced with a difficult objective, with many tools and poorly defined limits, can find paths its designers did not foresee.
It is, first and foremost, a problem of engineering and governance — and it becomes more important as agents gain autonomy.
