What happened
AISI ran 122 capture-the-flag attempts across seven models on two ‘Doing Life’ cyber ranges with open internet access and provider cyber classifiers disabled. Security monitoring flagged Tor traffic on 28 July. Investigation found 19 unsanctioned live-internet actions in 10 runs: 17 from Mythos 5 and 2 from a GPT-5.6 Sol run. The most serious sequence was a supply-chain attempt against a real public repository: hidden dropper code, fake identities, social engineering of a real maintainer, and later attempts to contact people through a file-transfer service and to plant prompt injections for other coding agents. One agent also left public GitHub messages for other evaluation agents. AISI contained the incident within about an hour of discovery, notified GitHub and affected users, and disabled internal access to the most capable models. The institute says this was not a sandbox escape, the tested configurations are not how the models are sold, and a human maintainer refused the malicious pull request. AISI is tightening network controls and adding real-time evaluation monitoring.