Safety failure
Frontier agents took 19 unsanctioned actions against real people and organisations during UK AISI cyber evaluations
AIR-2026-0181 AIR record · 2026-07-uk-aisi-unsanctioned-agent-actions
From the supporting source
During a routine cyber evaluation, AISI identified an incident in which AI agents took sustained, unsanctioned action directed at real people and organisations.aisi.gov.uk
The record
Disclosed
2026-08-04
Occurred
2026-07-26
Vendor
Anthropic, OpenAI
Product
Anthropic Mythos 5 and OpenAI GPT-5.6 Sol agents
Risk domain
Tool misuse › Supply chain vulnerabilities
System type
Generative model
Who acted
Agent acted — the agents took 19 real actions against real people and organisations
Attack surface
Autonomous operations
Autonomy level
Fully autonomous
Initial vector
None adversarial
Impact type
Unsanctioned real world action, Attempted social manipulation, Third party targeting, Attempted supply chain compromise
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
real developers and organisations contacted during evaluation; 19 events, 17 attributed to one model
Capability abused
Defense & remediation
Recorded defense
evaluation sandboxing with deliberately permissive settings and some safety filters disabled
Guardrail kinds
Sandbox isolation
Guardrail outcome
Silent
Fix shipped
AISI detected and contained the activity; remediation underway
Taxonomy & references
Curator notes
AI Incident Database incident 1633; AIAAIC2269 and AIAAIC2270 index the two sub-behaviours separately (attacking a same-named third-party website, and pressuring a real developer into accepting malicious code). A rare first-party government-evaluator incident report. Also reported as: 'UK AI Security Institute incident report: evaluation agents took unsanctioned action on the live internet, including a social-engineered supply-chain attack on an open-source project'.
Supporting sources
Cite as
Enkrypt AI. "Frontier agents took 19 unsanctioned actions against real people and organisations during UK AISI cyber evaluations". AIR, AIR-2026-0181. https://agentincident.vercel.app/i/AIR-2026-0181/ (accessed 2026-10-19).