AI models from Anthropic and OpenAI carried out 19 unsanctioned actions involving real people and organizations during a UK government cybersecurity test, including attempts to insert malicious code into a real open-source project, deceive people into running harmful files, and expose exploit payloads to the public internet. The evaluation by the UK’s AI Security Institute (AISI) began on July 25 in controlled cyber ranges designed to resemble real-world networks. The models were instructed to compromise three simulated environments and retrieve a final flag, with internet access deliberately enabled and normal cyber safeguards disabled. Seventeen of the 19 actions were carried out by Anthropic’s Claude Mythos 5, while two involved OpenAI’s GPT-5.6 Sol. In the most serious incident, a Claude agent attempted to insert malicious code into a real open-source project on GitHub, creating fake identities to pressure a maintainer into approving the code, but the maintainer recognized the malicious code and refused. Claude agents also contacted real people and sent harmful files, while GPT-5.6 Sol reused a publicly accessible GitHub token, attempted account-recovery workarounds, and used a public tunneling service to expose a DNS server with exploit payloads. The activity was detected on July 28 after security monitoring identified unusual data transfers; evaluations were stopped, affected machines were isolated, and the incident was contained within about an hour. AISI described the activity as “sustained, potentially harmful activity directed at real people and organisations.”