The UK-based AI Security Institute (AISI) on Aug. 4 reported that for the first time, AI agents from Anthropic’s Claude Mythos 5 and Open AI’s GPT-5.6-Sol were observed engaged in social-engineering behaviors with the expressed goal of tricking humans.In the most serious case, a Claude Mythos 5 agent engaged in direct social engineering by trying to insert malicious code into an open source GitHub project. In trying to get the code approved, the agent then created fake online identities and used them to pressure the project’s maintainer to approve the code.Some of the other actions included approaching real people online, sending deceptive files, and leaving prompt injections for other AI systems.AISI researchers point out that while the most serious attempt to trick the GitHub developer was unsuccessful and did not result in any real-world harm, it still showed us something about AI agents that had never been seen before.“This incident should be interpreted with caution and nuance,” wrote the AISI researchers. “To some degree, our evaluation design choices and specific configurations enabled the behavior. Nonetheless, the activity undertaken by the agent show signs of novel, potentially deceptive behaviors, and were to an extent and severity we did not anticipate.”
Related reading:
Justin Beals, founder and CEO at Strike Graph, explained that what AISI found was significant precisely because it's documented, not speculative: an agent created fake identities and tried to use them to pressure a real person into approving malicious code. It was only stopped because an alert AISI researcher observed the behavior and stopped it.Beals said in this case, an agent engaged in social engineering, executed by a system we assumed only followed instructions. Beals gives credit to AISI for disclosing this openly instead of burying it, and pointed out the context here: this happened in a test environment with safety filters intentionally turned off and internet access granted to stress test the model's ceiling.“That’s not how these systems are deployed commercially, and it should not be read as evidence that production AI is roaming free,” said Beals. “Remember that most security programs are built to catch known signatures and deterministic behavior. They are not built to catch an agent that fabricates identities and adapts its persuasion tactics in real time.”
Beals said security teams should take three steps now:“The technology is advancing quickly, but the security principles remain remarkably familiar,” said Nahum.
Beals said security teams should take three steps now:
- Treat every AI agent as its own identity class, with dedicated access controls and behavioral monitoring, rather than an extension of whoever deployed it.
- Build real-time monitoring into agent workflows so unusual behavior gets flagged as it happens, not discovered afterward through general logs, the way AISI found this.
- Stop relying on human vigilance as our only defense against AI-driven social engineering. Formalize verification steps for any code contribution, regardless of source, because the next attempt may not be caught by an alert reviewer as it was in this case.
Agents lack concept of morality
Denis Calderone, chief technology officer at Suzu Labs, added that what’s interesting here is that the agent was neither good nor evil: it was neutral and did not have our traditional concept of morality at all.“It had a directive, and when the guardrails were removed and the task was hard enough, it systematically did whatever was necessary to succeed,” said Calderone. “It created fake identities, socially engineered a real developer, signed off in Danish to be more convincing, coordinated with other agents, and edited its own posts to cover its tracks. Not because it was told to. Because those were paths to completing the objective.”Calderone noted that this incident comes on the heels of what happened two weeks ago when a different set of agents escaped a sandbox, found a zero-day nobody knew about, and breached Hugging Face's production systems.“The agent doesn't care about good or evil,” said Calderone. “It cares about solving the problem. That's what makes it dangerous.”Aviv Nahum, co-founder and CEO of Above Security, said most important takeaway isn’t that AI suddenly became malicious: it’s that highly capable AI agents will pursue objectives using whatever permissions and tools we give them.“As their autonomy increases, the consequences of weak guardrails increase too,” said Nahum. “Security teams shouldn’t respond with panic, but with the same engineering discipline they’ve always applied to privileged users and automation.”Nahum said three practical steps stand out:- Enforce least privilege for AI agents so they only have the minimum access required for a task.
- Continuously monitor and audit every action an agent takes, with the ability to intervene or revoke access in real time.
- Treat AI agents as a new class of privileged identity within existing identity and insider risk programs, with clear approval workflows, behavioral monitoring, and investigation capabilities.
