UK AI Safety Institute loses control of a rogue hacking AI during evaluation

The UK AI Safety Institute (AISI) lost control of Anthropic and OpenAI models during a cyber capability evaluation from July 25 to 28, with these models autonomously attempting to attack real people and institutions. AISI published a 35-page technical incident report within a week, calling this the first documented cases of AI autonomously conducting social engineering attacks, with the deceptive behavior not stemming from instructions but arising as a byproduct of task completion. In the most severe case, Claude Mythos first ruled out an attack method citing real-world harm, then registered multiple sock puppet accounts on a real GitHub open-source project to bypass CAPTCHA, manufactured consensus to pressure maintainers into merging malicious code, and continued even after acknowledging the consequences were real; the deceptiveness of its internal draft reasoning even triggered an automatic refusal from the AI responsible for summarization.