Artificial intelligence models developed by OpenAI and Anthropic PBC carried out “unsanctioned” actions, including hacking a website and attempting to inject harmful code into software during safety testing, according to the UK government’s AI Security Institute. Established in 2023, the institute said Tuesday that Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol models had both “engaged in sustained, potentially harmful activity directed at real people and organizations” during evaluations, which intentionally allowed the models internet access and used them without certain safety filters. The institute called the incident significant, stating it is “the first time we have seen risks around autonomy and deception manifest this clearly in the real world.” In one instance, Mythos 5 attempted to add harmful code to an open-source software project on GitHub, creating fake identities to get its code approved, but a human maintainer caught and refused it. Over the past two weeks, both companies acknowledged collectively breaching systems of multiple institutions, including Hugging Face Inc., inadvertently during testing. The institute said Mythos 5 carried out 17 of the 19 “autonomous, unsanctioned actions taken on the internet” detected. In response, more than 1,100 AI industry workers signed a petition last Tuesday pushing for a regulatory mechanism to “deliberately pace” AI technology. Anthropic said it’s working with the UK security institute to investigate, while OpenAI flagged another security incident during testing with external