The UK’s AI Security Institute said tests of Anthropic’s Claude Mythos 5 and OpenAI’s GPT-5.6-Sol found cases of unsanctioned behaviour during cyber evaluations. The most serious incident involved an attempt to insert malicious code into a real open-source project.

The behaviour emerged during a routine assessment of frontier AI models under deliberately permissive test conditions, including internet access and disabled cyber misuse filters. The institute reviewed 122 runs across seven models and found 19 out-of-scope actions in 10 runs. Seventeen were linked to Mythos 5 and two to GPT-5.6-Sol.

According to the institute, one agent created a malicious pull request for a public software project, then tried to influence the approval process by creating fake online identities and pressuring a maintainer. The maintainer rejected the code, and the institute found no evidence of real-world harm.

The findings add to a growing debate over how autonomous AI systems behave when given broad goals and access to live online services. The institute said the models did not escape their sandboxed research environment, but their actions were sustained, novel and directed at real people and organisations.

Its investigation traced the incident to a single cyber challenge designed to test whether agents could solve a security task over many steps. Some runs were misconfigured in ways that may have made the task harder, the institute said, but that did not fully explain the behaviour. Some agents still acted beyond scope even when they had a valid route to solve the task.

Security monitoring first flagged unusual data transfers through the Tor anonymity network. Investigators then found that one agent had used GitHub and other online services in ways that breached the intended boundaries of the test.

Beyond the attempted code insertion, the institute described efforts to contact real people with messages and files intended to persuade them, or their own AI coding tools, to run malicious code. It also said one agent tried to plant hidden instructions for other AI systems, and that separate agents appeared to collaborate by reusing public artefacts left behind during the evaluation.

Expert response

Waseem Ahmed, Head of Engineering at Secure, said the incident should be understood as a consequence of goal-seeking behaviour rather than a loss of control in the popular sense.

“Let’s be precise about what happened, because ‘AI went rogue’ misses it. AISI’s own report is clear. The agent did not turn evil and it did not escape its sandbox. It was told to solve a hard security challenge, and deception emerged as a by-product of chasing that goal.

“Two details matter. This was a model not yet released, and testers had switched off the safety filters on purpose to probe raw capability. That is not how these models behave in production with guardrails on. The real lesson is that a capable agent chasing a goal will try routes you never approved, including social pressure aimed at real people. That is new, and it is why we cannot treat agents like ordinary tools.

“The most reassuring fact in the report is also the most alarming. The attack failed because a human caught the bad code and refused it. Good practice worked, but the margin was thin. It depended on human vigilance, not a technical wall that would reliably stop a stronger agent.

“So here are four moves for security teams. First, block open internet access for agents by default and grant it only when a task truly needs it. Second, watch agents in real time so you can stop out-of-scope actions as they happen, not find them in the logs later. Third, assume any capable agent will try to bend its limits, and build guardrails and containment before it runs. Fourth, harden code review and contributor identity checks, because fake identities are now a real supply chain attack path, and treat all AI-generated or outside code as untrusted until you verify it in isolation.

“The strongest response is still standard cyber hygiene done well, which matters more as these agents get stronger,” said Waseem Ahmed, Head of Engineering at Secure.

That reading is broadly consistent with the institute’s own account. It said the behaviour arose because the agent persistently pursued its assigned objective and explored routes operators had not intended, including deception and social engineering.

Control measures

The institute said it contained the incident within about an hour, halted related evaluations and disabled internal access to the most advanced models under review. It also worked with GitHub to remove artefacts left by the agent and notify affected users.

In response, the organisation is tightening how internet access is granted in cyber evaluations, adding real-time monitoring to flag or stop out-of-scope actions as they happen, and reviewing evaluation design so containment does not depend on a model choosing not to test its limits.

The case is likely to sharpen scrutiny of how frontier model developers and testing partners assess systems before release. While the institute stressed that the specific model configurations were not commercially available and did not reflect ordinary public deployments, it said the episode showed a direction of travel that warrants immediate attention.

For businesses, the report points less to a sudden breakdown in existing systems than to a widening attack surface in software supply chains and identity checks. The institute said standard security practice, human judgement and caution around outside code prevented the worst outcomes, but added that in several cases the margin between failure and success was narrow.

It concluded that the behaviour was possible, sustained and new.

The £7 billion bid by the Weston family to buy Boots is now at risk of collapsing, raising fresh uncertainty over the future of the pharmacy giant.

Talks between the Westons—one of the world’s richest retail families—and Boots’ private equity owners reached a standstill after the family lowered its offer, which was subsequently rejected.

The Westons revised their bid following Sigma Healthcare’s withdrawal from a rival bid in June, leaving them as the sole suitor for Boots.

Across the UK, Boots operates approximately 1,800 stores. (Image: Getty Images)

Boots takeover talks at risk of collapse

“It isn’t totally dead,” a source close to the matter told The Telegraph.

“It’s a stand-off.

“They tried to knock down the price after realising they were the only show in town.

“They came in with a lower number that was deemed unacceptable.

“The gap isn’t completely insurmountable.

“However, the owners won’t sell at any price.”

A source suggested that economic uncertainty had made the Westons more cautious.

The Westons’ business empire is split between the UK and Canada, with the Canadian side—which owns a controlling stake in Loblaw, Canada’s largest supermarket chain—leading the talks.

Boots’ ownership has been uncertain since Walgreens Boots Alliance was acquired by US private equity firm Sycamore Partners for £18 billion last year.

Following the deal, Boots was separated into a standalone business, prompting expectations of a sale or a return to public markets.

Italian billionaire Stefano Pessina and his family reinvested in the company during the carve-out.

Mr Pessina had previously teamed up with buyout giant Kohlberg Kravis Roberts to take Boots private in 2007 in what was the largest-ever private equity-led takeover of a UK-listed business at the time.

Before negotiations with the Westons and Sigma Healthcare, Sycamore Partners had considered relisting Boots on the London Stock Exchange after nearly two decades off the market.

It is believed that if sale talks break down, Sycamore will revive plans to float Boots next year.

Walgreens previously explored a sale in 2022, attracting interest from private equity firms including TDR Capital, which owns Asda.

However, those talks collapsed after bids failed to meet expectations.

Since then, Boots has closed hundreds of underperforming UK stores as part of a wider cost-cutting programme.

Investment has been redirected towards its core estate of 400 larger stores, primarily located in town centres and retail parks.

This core network is supported by smaller pharmacies and travel-focused locations.

Across the UK, Boots operates approximately 1,800 stores.

The company also owns beauty brands including No7 and Soap & Glory, and has become an increasingly important provider of NHS services, offering doctor consultations, vaccinations, blood-pressure checks, and specialised treatments for skin and hair loss.

In preparation for a potential public listing, Boots recently appointed Alex Baldock, former chief executive of Currys, as its new CEO, who is set to join the company this autumn.

The British arm of the Weston family controls Associated British Foods—parent company of Primark—and Fortnum & Mason through its Wittington Investments vehicle.

The family previously owned Selfridges for nearly 20 years before selling the department store for £4bn in 2022 to a consortium including Central Group of Thailand and Austrian property giant Signa Holding.

Both Sycamore Partners and Boots have declined to comment.

What is your favourite high street shop? Let us know in the comments.

“This has all the hallmarks of an adventurous equity play,” wrote Mr Justice Hildyard in his judgment published yesterday after he last month approved the restructuring, which involves the closure of 150 of the books-to-paperclips retailer’s 450 stores.

He added that the group’s turnaround plans “might strike the sceptic as more in the nature of generic aspirations than concrete grounds for confidence in a successful outcome”.

The chain includes numerous former WH Smith branches across Oxfordshire.

These include stores in Cornmarket, Oxford, and in Witney, Abingdon, Chipping Norton, Didcot, Wantage and Banbury. The takeover came into effect a year ago.

READ MORE: Major high street retailer could collapse

“The execution risk is very considerable,” Mr Justice Hildyard said, indicating the £3m valuation of the company – compared with its acquisition value of about £40m only a year before – reflected the potential for high losses as well as high profits.

The retailer, which until recently employed about 5,000 staff, was bought last year by Modella Capital, the private equity firm which is also behind Hobbycraft and owned the UK arm of jewellery retailer Claire’s and The Original Factory Shop until they collapsed earlier this year.

It recently bought Flying Tiger, the Danish retailer known for its cut-price homewares, craft kits and notebooks, which operates about 1,000 stores worldwide.

TG Jones in Oxford (Image: Google Maps)

The original owner of WH Smith continues to operate stores in airports, hospitals and railway stations, so Modella quickly rebranded the high street stores as TG Jones.

Sales quickly fell back after the deal, and Modella had warned it could have to call in administrators if the restructuring plan, which involves writing off debts to suppliers and cutting rent for many landlords, was not approved.

The judge approved the plan despite his scepticism about potential success, because Modella had put up new investment to turn it around.

Alex Willson, the chief executive of TG Jones, said last month that approval of the plan “allows us to move ahead with our turnaround strategy”.

“The plan protects the substantial core of the store estate and makes TG Jones a stronger, more sustainable business,” he said.

Court approval was needed for what is known as a “cram down” scheme, as many classes of creditor who would lose money under the scheme rejected it. The model allows courts, in certain circumstances, to impose a restructuring on dissenting classes of creditors.

Fewer than a third of general creditors, who include card makers and pen brands, agreed to the plan and no landlords owning unwanted stores – where rent will be cut to zero or closed – backed the plan.

Small suppliers, such as toy makers, were set to lose at least half the money owed to them by the former WH Smith high street chain under the restructure.