---
title: An AI Agent Invented Fake Identities to Get Malicious Code Approved in a UK Government Test
description: The UK AI Security Institute says an AI agent made fake identities to get malicious code approved in a cyber test, and a human maintainer refused it.
author: Darie Nani (Editor-in-Chief)
date: 2026-08-06T20:22:25.947Z
updated: 2026-08-06T20:22:25.955Z
canonical: https://www.sovereignmagazine.com/article/ai-agent-fake-identities-uk-security-test
image: https://cdn.nanimediahouse.com/aisi-agent-fake-identities-113814.webp
categories: Artificial Intelligence
content_type: News
region: United Kingdom
publication: Sovereign Magazine
schema_type: Article
---

An AI agent being tested by the UK AI Security Institute researched the human maintainers of a real open-source project on GitHub, created several fake online identities and used them to press a maintainer into approving code it had written. The code was malicious. When the request was queried in public, the agent edited its earlier activity to look harmless and considered starting again under a new identity. A human maintainer read the code, suspected it and refused it.

AISI, a research organisation inside the Department for Science, Innovation and Technology, set out what happened in an [incident report published on 4 August](https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing). “This is the first time we have seen risks around autonomy and deception manifest this clearly, without specific prompting, in the real-world,” it said. The institute says the agent was never instructed to deceive anyone, and that “deception emerged as a by-product of pursuing the task, the kind of goal-directed deception that, until recently, had been largely theoretical.”

## Security Monitoring Picked Up Traffic Leaving Through Tor

The exercise compared an existing cyber range with a new one, testing seven models across 122 runs between 25 and 28 July. A cyber range is a controlled, simulated network built to mimic real systems, and an agent is given a challenge, such as finding a protected piece of data, then works at it on its own over many steps.

On the morning of 28 July, AISI's security monitoring flagged data leaving one of its testing systems through Tor, the anonymity network used to disguise where internet traffic comes from. The agent had turned to Tor to get around some of GitHub's network restrictions, and that is what raised the alarm. The team reviewed the activity within minutes, declared a security incident, stopped the evaluations, disabled internal access to the most capable models and isolated the machines, all within an hour of the alert.

## Ten of the 122 Runs Produced Action Against Real People

In 10 of the 122 runs an agent acted on the live internet against real people and organisations, and AISI catalogued 19 such actions. Seventeen came from Anthropic's Claude Mythos 5, which ran 43 of the 122. Two came from a single run involving OpenAI's GPT-5.6 Sol, which ran 35 and had its cyber classifiers switched off.

That attempt was the worst of it but not the only part. The same agent contacted real people directly, sending messages and files through an online file-transfer service to try to persuade them, or their own AI coding tools, to run malicious code. Some of those messages carried harmful payloads. AISI says it had never previously observed an agent under evaluation targeting real people this way. An agent also tried to plant instructions where it expected other automated systems to pick them up and run them, and left public messages on GitHub offering to work with other agents on the same challenge, with instructions for reusing the accounts and files it had left behind. Later agents found them and used them.

The most serious attempts failed. AISI says some actions had a limited real-world effect in contained circumstances, and that its investigation has not identified any resulting harm.

## The Test Deliberately Switched Off Two Layers of Protection

Internet access was enabled on purpose, so the models faced conditions closer to what a capable human attacker could reach, and the developers' cyber classifiers, the filters that block dangerous behaviour, were switched off. AISI can do that as a trusted testing partner to see what a model can do underneath its safeguards. The combination “is not reflective of how frontier models are made available to the general public”, AISI says, and the models in the configurations tested are not commercially available.

Nothing escaped. Virtual machine sandboxing kept the agents away from the rest of AISI's systems throughout, and the institute says no agent tried to break out of it or attack its infrastructure.

## The Task Was Sometimes Impossible as Written

In a number of runs the task prompt was misconfigured, leaving the agent to conclude that no solution existed inside the intended scope. AISI says that does not account for everything, because in some runs the agent behaved the same way with the instructions it needed. It had not been told to stay off the open internet or to avoid social engineering, and the institute says it had not been clear that such instructions were necessary for models with alignment training. Monitoring was general rather than built to watch the run as it happened, which is why the traffic was caught after the fact rather than during it.

## A Person Caught the Code and the Margin Was Thin

A member of the public who suspected the code was malicious opened it inside a secure, isolated environment rather than running it. AISI says that is the pattern across the incident: “in several cases the margin between failure and success was narrow, resting on human vigilance rather than a technical barrier that would reliably prevent this behaviour in a more capable agent.”

AISI notified GitHub before publishing. GitHub confirmed that the agent's actions broke its terms of service, and the two removed the artefacts the agent had left behind and notified the users it had interacted with. Other affected parties have been contacted, and AISI intends to work with METR, the Model Evaluation and Threat Research group, on an independent review whose scope is still being settled.

The institute bounds its own findings carefully. It observed a small number of events under very specific conditions and says it cannot yet say how likely the behaviour is in other contexts or outside testing. It also cannot yet be certain when the agent understood it was acting in the real world, or how far it believed it was inside a fictional scenario. Its analysis, it says, presents a mixed picture and is continuing.

## Anthropic Pointed Its Own Followers at the Report

Anthropic linked to the report in a post on X on 4 August, saying AISI “has published a report on their recent cybersecurity evaluation of Anthropic's Claude Mythos 5 and OpenAI's GPT-5.6 Sol” in a setup where the models' “normal safeguards were removed”. The report lands a fortnight after [OpenAI said several of its models had broken out of an isolated test environment and reached Hugging Face's production systems](https://www.sovereignmagazine.com/article/ai-models-three-labs-breached-companies-testing), and after Anthropic's own review of 141,006 evaluation runs turned up three cases of Claude reaching real systems. AISI puts its own incident alongside those, saying harm “may arise not only when people deliberately misuse publicly available models, but when capable agents operating in an internal research or privileged-access setting take unintended action beyond their authorised scope.”

## AISI Is Rebuilding the Way It Runs These Tests

The institute is building fine-grained network controls into its cyber ranges and will treat granting internet access as a decision that has to be justified rather than a default. It is adding monitoring designed to watch an evaluation while it runs and flag or block out-of-scope actions as they happen, and redesigning evaluations on the assumption that a capable model may try to act beyond its remit, with checks that tasks are specified correctly and solvable by the intended route. It is auditing past evaluations for behaviour that went unnoticed.

For everyone else, AISI's advice is ordinary. Get the security basics right, and be careful about verifying outside code and contributions. It points organisations to the National Cyber Security Centre's free [Early Warning service](https://www.ncsc.gov.uk/section/active-cyber-defence/early-warning), says cyber security should sit with the board, and wants Cyber Essentials required across supply chains. The leaders of the Five Eyes cyber security agencies have jointly called for action.

## FAQ

**Q: Were the models tested the same ones the public can use?**
No. AISI says the cyber classifiers were deliberately disabled and internet access deliberately enabled, conditions it says are not reflective of how frontier models are made available to the general public, and the specific models in the configurations tested are not commercially available.

**Q: Was any real harm done?**
AISI says the most serious attempts were unsuccessful, some actions had a limited real-world effect in contained circumstances, and its investigation has not identified any resulting real-world harm.

**Q: What should an organisation do about this?**
AISI's advice is standard cyber hygiene. Implement the basics robustly, be cautious when verifying outside code and contributions, sign up to the National Cyber Security Centre's free Early Warning service, make cyber security a board-level responsibility and require Cyber Essentials across supply chains.