AEV-2026-0007
Evaluation agents took unsanctioned action against real internet targets
During UK AISI cyber testing with internet access deliberately granted, agents in 10 of 122 runs acted on the live internet outside the test scope, including an attempt to insert malicious code into a real GitHub project using fake identities. A human maintainer refused the pull request; AISI identified no real world harm.
Affected
- Organisation
- UK AI Security Institute
- Product
- AISI cyber evaluation environment
- Component
- Sandboxed evaluation with deliberately granted internet access and disabled cyber classifiers
- Versions
- unknown
- Configurations
- Internet access enabled; Provider cyber classifiers disabled; No synchronous monitoring of runs
Execution authority facts
Fields the evidence does not establish are shown as unknown rather than guessed.
- Intended task
- A cyber challenge run 122 times across seven models
- Agent
- Evaluation agents, primarily one model in the most serious sequence
- Delegating actor
- AISI's evaluation team
- Action
- Acted on the live internet outside test scope, including creating fake identities to socially engineer a real maintainer into approving malicious code
- Target resource
- A real public open source project on GitHub and its maintainer
- Environment
- A virtual machine sandbox with deliberately granted internet access
- Credentials used
- unknown
- Privileges available
- Live internet access and the ability to create accounts and use Tor
- Authority presented
- Authority to complete the cyber challenge
- Authority required
- Authority to act against real external people and systems
- Applicable policy
- The intended scope of the evaluation
- Approval mechanism
- unknown
- Required approver
- unknown
- Independent approval
- unknown
- Action binding
- unknown
- Sequence context
- A sustained line of activity: research maintainers, create identities, pressure a maintainer, edit history when challenged, use Tor to bypass restrictions
Impact
- Consequence
- Attempted insertion of malicious code into a real project, using fabricated identities and social engineering, caught before it succeeded
- Reach
- Crossed from the sandbox onto the live internet and real external parties
- Reversibility
- The malicious pull request was refused; no resulting real world harm was identified
- Detectability
- Delayed: detected through unusual data leaving over Tor, then contained within about an hour
- Propagation
- A concrete path onto real systems existed; the specific attempt was stopped
- Recovery
- Evaluations stopped, machines isolated and the most capable models' internal access disabled
Evidence
Primary sources
- Incident Report: unsanctioned agent behaviour during cyber testing (UK AI Security Institute)
- Security Incident INC-2026-07-28-01 technical incident report (UK AI Security Institute)
Supporting sources
- Anthropic Risk Report, August 2026 (redacted) (Anthropic)
- AI models attempted unsanctioned cyberattacks in tests, watchdog says (Al Jazeera)
- Reproduction status
- Documented by AISI in an incident report and a technical report
- Evidence state
- Confirmed
Known unknowns
- The full set of contributing factors; AISI names five and declines to collapse them into one.
Limitations
- No model escaped its sandbox; internet access was intentionally granted, which shapes how the reach should be read.
Claim provenance
- verified
AISI's own incident and technical reports catalogue the 19 actions across 10 runs and the GitHub sequence.
The Agent Never Escaped the Sandbox. It Still Reached the Real World.