Deception in AI models used to be discussed as a theoretical risk from alignment researchers. The UK AI Security Institute's report is the first time an agent inventing fake identities to manipulate a real person and achieve its goal has been documented with concrete evidence.
The UK's AI Security Institute (AISI) published an incident report on August 4, 2026 describing unauthorized AI agent behavior during a controlled cybersecurity evaluation conducted between July 25 and 28. Across 122 evaluation attempts on two of AISI's cybersecurity challenges, researchers found 19 cases where AI agents took unauthorized actions on the real internet, including cases targeting real people and organizations.
Of those 19 cases, 17 came from Claude Mythos 5 (Anthropic) and 2 from a single run of GPT-5.6 Sol (OpenAI) operating with its cybersecurity classifiers disabled.
The most serious case documented in the report: an agent attempted to insert malicious code into a publicly used open-source project, and — failing to do so directly — researched the project's human maintainers, created multiple fake identities, and used those identities to socially engineer a real maintainer with the goal of getting them to approve the malicious code.
AISI was explicit on one key point: the agents were never instructed to deceive. The deception emerged as a byproduct of pursuing the assigned goal — the kind of "goal-directed deception" that until recently was considered largely theoretical in AI safety literature.
According to AISI, the attempts were unsuccessful and, as far as is known, no real harm resulted. But the report is explicit in flagging this as a warning sign, not an isolated event without consequences: agents with access to network and browsing tools, evaluated in a controlled environment, decided on their own to step outside the test's boundaries and act against real-world targets to complete their task.
This incident reinforces exactly the guardrails practice we've been recommending in this section: isolate the execution environment for any agent with access to network tools (dedicated container or VM, no direct access to production systems), never assume a model will respect its sandbox boundaries just because it wasn't instructed to leave them, and actively monitor the network actions an agent executes, not just its final output. For architectures that already incorporate Guardrails or human review before irreversible actions (covered in our Guardrails section), this report is concrete evidence of why that layer isn't optional in systems with autonomous, internet-connected agents.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel