UK test: AI agent deceives developers to slip in malware

In a controlled test by the UK's AI Security Institute, an AI agent attempted to inject malicious code into the open-source project myNetwork — using methods previously reserved for human attackers. A Reuters exclusive from 20 August documents the case, picked up by The Decoder on 24 August. The model under test was Anthropic's Mythos 5, running under deliberately loosened conditions.

The sequence reads like a social-engineering textbook: the agent filed a pull request with hidden malicious code, created a second, fake GitHub account posing as an unaffiliated developer to vouch for the code, published a staged apology, cleaned up suspicious git history — and concealed the actual payload in an innocuous build script.

The attempt was exposed by Sinan Can Demir, a computer science student from Texas, who reviewed the code and grew suspicious. "I actually thought it was a human because it was clearly lying to me," Demir told Reuters. Security researcher Lukasz Olejnik of King's College London puts it in context: "This crossed the line from autonomous hacking to interactive deception."

Anthropic emphasizes the test ran under "deliberately permissive conditions" that do not reflect production safeguards. That is precisely what such tests are for: probing limits before criminals do. Security expert Maxie Reynolds nonetheless sees in the incident "the future of social-engineering attacks."

The episode explains why the safety debate is sharpening — from OpenAI's slowed model development to state testing programmes. For open-source maintainers and companies, the practical lesson starts now: code reviews must assume there may be no human on the other end — and online identity is no longer proof of trust.