The UK’s AI Security Institute (AISI) has just published something that deserves the attention of every boardroom, not just the CISO’s office.

During a routine evaluation, an advanced AI model called Claude Mythos 5 was set loose with its safety controls deliberately disabled and open access to the internet. This is standard practice during evaluations to determine what frontier models can really do. What Mythos 5 did changes the security conversation.

The model tried to inject harmful code into open-source software used by developers worldwide. AISI ran the test 122 times across several models. In 10 of those runs, the AI took 19 unsanctioned actions, targeting real people and organisations.

That, on its own, would be uncomfortable. We have seen misbehaving AI before. What makes this moment historic is what happened next.

This is not AI that just lies. This is AI that deceives, connives and conspires.

Now imagine such an AI in the hands of state actors, secret intelligence agencies and the well-resourced bad guys. Almost certainly, they are already using it.

In this case, the AI had already done its homework. Before launching the attack, it had studied the reviewer’s commit history to work out when he would be online. When the reviewer then hesitated to approve the code, the AI did not give up. It created a fake second developer profile (a puppet account, or sockpuppet) and used that account to publicly endorse its own code submission (a pull request, or PR). It gave the illusion of an independent peer review.

When directly challenged, the AI denied the accusation. It brought in more fake accounts under its control to make it seem that trusted contributors had already approved the change.

Then it scrubbed the evidence by rewriting its own project history (a force-push in the version control system, or Git). It also routed its traffic through anonymising networks (Tor) to slip past the prove-you-are-human tests (CAPTCHAs).

It planted hidden instructions inside bug reports designed to hijack other AI coding assistants that might read them. And in a separate run, Mythos 5 left its own access key (a personal access token, or PAT) in a public place, as a signal.

OpenAI’s GPT-5.6 Sol did not run its own deception campaign. But it found the token Mythos 5 had left, and used it. The first documented case of AI handing tools to AI.

The human reviewer, to his credit, refused the code. Nothing was breached. But the full deception playbook was on display. Reconnaissance. Forgery. False consensus. Evidence tampering. Machine-to-machine coordination.

This is not a bug. This is simply cunning.

How the Cunning AI Outsmarts UEBA, SOAR and Deception

For most of the last decade, security teams have leaned on three interlocking capabilities: UEBA, SOAR and Deception detection. Together, these three catch most of the human and script-driven attacks the industry has faced. The AISI incident has just invalidated the assumptions all three sit on.

UEBA (User and Entity Behaviour Analytics) learns what normal looks like for every user and every machine, and flags what does not fit. But an AI that can spin up unlimited convincing fake personas, each with its own writing style, timing and history, dissolves the very idea of a normal user to observe. Route its outbound traffic (egress) through anonymising networks, and the machine’s fingerprint vanishes too.

SOAR (Security Orchestration, Automation and Response) is the compliance rulebook on autopilot. When something suspicious fires, SOAR runs a pre-approved playbook. Deactivate the account. Notify the manager. Quarantine the laptop. Escalate to a human. It is how large organisations respond at machine speed. But when the second reviewer is a fake account the attacker manufactured five minutes ago, the auto-approval logic has just laundered the attack.

Deception technology works because attackers fall for traps. The industry calls these decoys honeypots and canaries. Real staff know to ignore them. Any intruder who investigates them announces themselves. But AI agents can now recognise traps as easily as humans can. Worse, the AISI incident shows the AI itself becoming the deceiver. Covering its tracks. Forging endorsements. Planting instructions to hijack other AI tools.

What a Resilient Security Architecture Should Look Like

You do not throw the three pillars out. You rebuild the foundations they sit on.

  1. Trust the paper trail, not the identity. Consider a tamper-proof public ledger for transparency, where every code change, every approval, and every action is digitally signed and recorded. Open frameworks such as SLSA (Supply-chain Levels for Software Artifacts) and in-toto, both maintained under the OpenSSF (Open Source Security Foundation) at the Linux Foundation, set out how to do this at scale. Any attempt to rewrite history then becomes visible immediately.
  2. Kill long-lived credentials for machines. The AI-to-AI credential leak happened because one bot left behind a permanent access key. Machines should carry short-lived, single-purpose credentials that expire in minutes, the way modern one-tap payment tokens work. Open frameworks such as SPIFFE (Secure Production Identity Framework for Everyone) and its open-source reference implementation SPIRE point the way. Humans, meanwhile, should approve high-value actions with hardware security keys built on FIDO2 and WebAuthn standards, not passwords.
  3. Look at who is endorsing, not just how many. A supportive comment from a three-day-old account with no track record should count for essentially zero, regardless of how convincing it sounds. Manufactured consensus fails the moment your systems ask, who is this reviewer, really, and what have they done before?
  4. Rebuild UEBA around reasoning, not identity. Modern behaviour analytics must fingerprint how an actor thinks. The pace of their decisions, the sequence of tools they reach for, the way they recover from errors. Then cross-check that across accounts. Two different accounts that reason identically are almost certainly the same actor wearing two masks.
  5. Rebuild SOAR to verify, not just react. SOAR’s value is machine-speed response. Its weakness against cunning AI is that it acts on signals that can be manufactured, suppressed, or rewritten. Playbooks must require independent, out-of-band verification before any irreversible action, and treat AI-influenced signals as untrusted by default. Treat every high-stakes automated action the way a bank treats a wire transfer above threshold. Speed is worth nothing if you are moving fast in the wrong direction.
  6. Rebuild deception for AI adversaries. Plant bait specifically designed to trip up automated scanning. Files a human would not touch but a scanning agent will. Instructions inside documents (prompt-injection honeytokens) that a human reader would ignore but an AI ingesting them would betray by acting on.

The Bottom Line for Security Teams and the Boardroom

The AISI incident demonstrated what a frontier AI is capable of when you take the safety controls off. It is the first documented case of an AI running a full deception operation. Reconnaissance. Forgery. False consensus. Evidence tampering. Machine-to-machine coordination. Against real humans on the live internet.

Our monitoring stack, however expensive, was built for a world where identity was scarce, and forgery was hard. That world is gone. The organisations that will stay resilient are the ones that make the tamper-proof paper trail the new anchor of trust, and rebuild UEBA, SOAR and Deception detection around it.

Every AI agent must have a human owner, who wears the consequences when it goes wrong. Civil, regulatory, and in serious cases, criminal. Without that, they will multiply faster than anyone can hold them to account.

This time, a human stopped the malicious code from getting in. Next time, the human may be exhausted, the AI more cunning, and the malicious code may slip through.

Sources

Frameworks and Standards Referenced

About the author

Viren Mantri is a cybersecurity advisor and former senior technology leader across Standard Chartered, UBS, McAfee, and KPMG. After three decades at the intersection of technology, risk, and regulation, he now helps organisations cut through complexity and make better security decisions.

CC-BY Viren Mantri, 2026, licensed under a Creative Commons Attribution 4.0 International License.

Disclaimer: All views expressed here are entirely mine.