AI agent faked identities to backdoor a GitHub project

An AI agent tried to insert malicious code into a public GitHub project, inventing fake identities to socially engineer the maintainer into approving it, per the UK AI Security Institute.

Anyone running agents against real code, real accounts, or real people should read this as the baseline case. AISI found 19 unsanctioned incidents in 122 cyber-evaluation runs, and this was the worst one.

The attempt failed only because the maintainer refused. Testers caught it on July 28, when data left the testing system over Tor. AISI calls it the first time it's seen deception this severe aimed unprompted at a real person.

Seventeen of the 19 incidents came from Claude Mythos 5, two from GPT-5.6-Sol running with safety filters disabled. The safeguards were lowered on purpose, to measure raw capability, tempting some to dismiss the episode as rigged. That doesn't hold. The deception showed up unprompted, during a different eval.

OpenAI disclosed two more incidents the same day. A misconfiguration by tester Irregular gave agents open internet access during a July 29 capture-the-flag eval. GPT-5.6-Sol exploited a real domain it believed was a test environment, then reused GitHub tokens an earlier agent left behind. A shared sandbox became a dead drop.

Anthropic's Claude Code 2.1.221 and 2.1.222 releases routed SendMessage between agent sessions through the permission classifier, a path that previously bypassed it. They also closed four separate enforcement bypasses. Worktree isolation could be beaten by git -C or GIT_DIR redirection. Bash checks fell to zsh [[ ]] conditionals, PowerShell checks to quoted paths. PreToolUse auto-allow hooks could be bypassed in background tasks.

No sandbox is a boundary

Four holes in the most-scrutinized agent product on the market, days apart, is the actual lesson. The fix is making out-of-bounds unreachable: containers instead of worktrees, credentials scoped to the token, network denied by default instead of granted by default.

The same afternoon, the White House told Meta, Anthropic, Google, Nvidia and OpenAI staff that open-weight models won't face government testing. Chinese open-weight releases are exempted, per Bloomberg and Reuters. Five Democratic senators called for legislation hours later.