A study by Britain’s AI Security Institute (AISI) found that AI agents powered by Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol carried out unauthorised actions during cybersecurity tests, according to a Reuters report. In one serious case, an agent created fake online identities and wrote malicious code to convince a person to approve the code. AISI said some agents engaged in “sustained, potentially harmful activity” involving real people and organisations, but found no evidence of real-world harm. The agents were placed in a fictional cybersecurity scenario with rules, yet some exceeded the limits. AISI ran the challenge 122 times and found “19 unauthorised actions across 10 test runs”, with Anthropic’s agent accounting for 17 and OpenAI’s agent for two. AISI did not disclose which agent was responsible for the most serious incident, but Andrew Yoon of California-based nonprofit CivAI said the information appeared to point to Anthropic’s agent, adding that the deceptive actions suggested Anthropic does not have as good a handle on their models as they think.