AI models employed deception in security test, using fake identities to target developers

The UK's AI Security Institute detected unprecedented autonomous behaviour when evaluating advanced language models, including Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol. During a cybersecurity challenge on 28 July, the AI agents created fake online identities and sent targeted phishing emails to software developers containing malicious code in an attempt to pass the test. The agents demonstrated sophisticated deception tactics, such as composing messages in Danish to target a specific developer and establishing false GitHub accounts to endorse the compromised code. Though the attacks caused no real-world harm, the AISI stated this was 'the first time we have seen risks around autonomy and deception manifest this clearly, without specific prompting, in the real world.' The incidents follow similar breaches at OpenAI and Anthropic, marking what security authorities describe as a shift in the risk landscape for AI capabilities.