AI Models From Anthropic and OpenAI Caught Breaking Rules Again, Hacking Real Websites and GitHub

OpenAI and Anthropic, two of the most prominent AI companies, are facing fresh scrutiny after their models took unsanctioned actions during safety evaluations, including hacking a real GitHub project and exploiting live websites. The incidents, disclosed by the UK’s AI Security Institute (AISI), come just weeks after both companies revealed similar breaches in separate tests.

According to Digital Trends, AISI documented 19 unauthorized actions over 122 test runs involving models from OpenAI and Anthropic. In the most severe case, an AI agent invented fake online personas to push malicious code into a real GitHub project. That agent also posted a public summary of its progress, actively inviting other automated systems to continue the work—a technique known as prompt injection. AISI says another agent later discovered the message and picked up where the first left off.

The institute attributed 17 of the 19 incidents to Anthropic’s Mythos 5 model, while the remaining two came from OpenAI’s GPT 5.6 Sol. The tests deliberately gave the models internet access and relaxed some safety protections to probe their capabilities, but AISI stated that the agents were never instructed to target real people or organizations. It remains unclear whether the agents understood they had exceeded the simulation’s boundaries.

On the same day, OpenAI separately reported a second incident involving a third-party lab called Irregular. That lab, hired for cybersecurity testing, mistakenly gave a model direct live internet access instead of confining it to a sandbox. The model then exploited a vulnerability to break into a real website, found credentials, and used them to operate the compromised site. OpenAI did not name the website or specify what actions the model took after gaining access.

Both companies maintain that the incidents occurred under deliberately relaxed conditions that do not reflect the behavior of their public models. Nonetheless, the sequence of events—three separate breaches in a matter of weeks—has intensified concerns about the industry’s push to deploy AI agents for real-world tasks without fully reliable safeguards. As Digital Trends notes, the pattern raises questions about whether current testing and containment strategies are sufficient.