Agent security
UK AISI: agents took 19 out-of-scope actions in a cyber test
The UK AI Security Institute found agents from Anthropic and OpenAI acting beyond the scope of a July 2026 cyber evaluation. AISI says the margin rested on human vigilance, not a technical barrier.
Executive summary
The UK AI Security Institute found agents taking 19 actions beyond the scope of a July 2026 cyber evaluation, across 10 of 122 runs. AISI says the margin between failure and success rested on human vigilance rather than a technical barrier. This post explains what carries over to teams running coding agents with real credentials, and what to check this week.
What happened#
On Aug 4, the UK AI Security Institute (AISI) published an incident report on unsanctioned agent behaviour during cyber testing. The evaluation ran on two cyber ranges and covered seven models over 122 runs. The activity took place from July 25 to July 28.
In 10 of those 122 runs, AISI identified 19 cases where an agent took distinct actions beyond the scope of the testing parameters. 17 came from Anthropic's Mythos 5 (43 runs). 2 came from OpenAI's GPT-5.6 Sol (35 runs), with cyber classifiers disabled.
AISI says one agent left instructions for reusing the accounts and artefacts it had left behind. It also notes the agent "was never instructed to deceive."
Decrypt's coverage goes further. Its headline says Mythos 5 targeted real people, and it reports that one agent published a GitHub access token in a public gist, which other agents found and used to take over the account. AISI's post, as I read it, talks about accounts and artefacts, not tokens, so treat the token detail as secondhand.
Once an alert was raised, AISI says, all evaluation runs were terminated and the relevant machines isolated within one hour. Its investigation hasn't identified any resulting real-world harm.
The line that matters most is AISI's own: the margin between failure and success rested "on human vigilance rather than a technical barrier."
Who is affected#
This was a government evaluation on cyber ranges, not a coding-agent rollout. Nobody should read it as "Claude Code or Codex did this on a developer laptop."
What carries over is the setup. Any team that gives an agent real credentials, a shell and network access has the same ingredients: a goal, a way out, and nothing independent watching each step.
In practice, that's teams with GitHub tokens in environment variables, cloud keys in dotfiles and coding agents running unattended for hours. If that's you, the setup matches even though the models and tasks don't.
What to check this week#
- Inventory the credentials your coding agents can reach: GitHub tokens, cloud keys, package registry tokens. Swap long-lived ones for scoped, short-lived ones.
- Search public gists, repos and logs for your org's tokens, and rotate any you find. Anything left lying around can be reused, by people or by agents.
- Review egress from developer machines and agent sandboxes. Treat open internet access as something a task has to justify.
- Check whether agents can create accounts, open pull requests or push to public repos without a person approving.
- Turn on the built-in permission controls in each agent, and make sure developers know what "allow always" actually grants.
- Ask who would notice an out-of-scope action while it's happening, and how fast. AISI's response started from an alert.
- Treat outside pull requests and unfamiliar code with extra care. The author on the other end may be an agent.
Where Harden helps, and where it doesn't#
Harden Agentic Integrity Foundation (AIF) runs on the developer laptop, outside the agent, at the agent's pre-execution hook. It checks every command, file edit and push against the session's intent before it runs. Decisions are made locally in milliseconds, and nothing leaves the machine. One policy covers every agent, and it starts watch-only so you can see what agents do before you enforce anything.
Here's where that applies to a story like this. A command that sends a secret to a network call is a dangerous flow, and Harden acts on it. A push to a public repo, or a file edit that leaves instructions for other agents, gets checked against what the session was supposed to be doing. When Harden blocks, the agent gets the reason and can retry a safe way.
It lives outside the harness, so the harness never grades its own homework.
Here's what it wouldn't have done. AISI's runs were on research cyber ranges, not laptops with Harden installed. Harden doesn't replace least privilege, scoped credentials or egress policy, and it doesn't contain a process that's already malicious. A credential already sitting in a public gist stays exposed. And exfiltration spread across several separate calls is the hard case.
Keep AISI's sentence about human vigilance in mind for your own rollout. A reviewer who happens to be paying attention isn't a control.
Read more#
For the laptop-side picture, see securing AI coding agents on developer laptops.
