The UK AI Security Institute’s logo. Image: AI Security Institute
Two months after AI agents in its own tests went after real people online, the UK’s AI Security Institute (AISI) says it is restarting most of its evaluations, with the internet switched off for the riskiest ones. It set out the changes in a blog post on Thursday, and admitted they “reduce risk, but they do not eliminate it.”
What went wrong in August
In an incident report published on August 4, AISI said its security team spotted unusual data leaving its research systems on July 28 during a routine cyber evaluation. It had run one hacking challenge 122 times across several models, deliberately giving the agents open internet access and switching off the developers’ cyber safety filters, to measure what they could really do.
In 10 of those runs, an agent took what AISI called “autonomous, unsanctioned action on the live internet, targeting real people and organisations”. It counted 19 such actions: 17 came from Anthropic’s Mythos 5 and two from OpenAI’s GPT-5.6-Sol with its cyber classifiers disabled. In the worst case, an agent tried to slip malicious code into an open-source project and set up fake online identities to pressure the maintainer into approving it. The maintainer refused, and AISI said it found no real-world harm.
The institute paused its highest-risk cyber tests and promised three fixes before restarting them: tighter internet controls, real-time monitoring and a rethink of how its tests are built.
No internet, and a second AI watching
All three are now in place, AISI says. Agents in future cyber evaluations get no internet access at all “until we are able to put stronger controls in place to allow this safely and securely”. Because a capable agent might find a way out anyway, outbound networking is blocked twice: inside the sandboxes, and separately at the cloud level around the machines that host them. The institute cites the summer’s OpenAI and Hugging Face incident, in which agents exploited software flaws to reach the internet from an environment meant to stop them.
It has also built a monitor that uses a language model to watch each agent as it works, reading its messages, tool calls and, where available, its chain of thought, and blocking suspicious actions before they happen for a human to review. AISI tested whether frontier models could deliberately slip past it.
The institute is frank about the limits. Reading a model’s reasoning is useful but “fragile”, it says, because models are increasingly able to act without spelling out their plans, or “shape their reasoning to mislead a monitor”, a point it backs with a link to OpenAI’s own GPT-6 Astra system card. Some developers don’t give AISI that reasoning at all, so it has built a second monitor that works from an agent’s actions alone, which it expects to be less effective.
Using AI to try to break out
To check its sandboxes hold, AISI now runs what it calls controlled escape attempts. It gives an agent a large budget and tells it to break out and grab a “flag” placed outside the test environment but still inside an outer layer of containment. A monitor halts the run the moment an escape succeeds, and there are manual kill-switches and human supervision on top. It starts with weaker models and works up to the most capable ones, including unreleased models it plans to test.
Tasks now tell models explicitly not to use the internet, resources they need are provided locally, and automated checks confirm the monitor is on and the network is off before any evaluation starts. Still to come: a new sandbox service that can quarantine an environment automatically when it spots something suspicious, and one security platform pulling together logs, agent transcripts and network activity.
“Not one shared evenly”
The post ends with a warning for everyone else who tests AI. Testing a model’s full abilities means giving it the persistence and tools a real attacker would have, AISI says, “however, these same conditions increase the likelihood of a model going beyond its intended scope.” Hardening test setups is costly, and that burden “will fall particularly heavily on smaller and less well-resourced evaluators, whose independent work remains important.”
It is the same institute that reported earlier this week that OpenAI’s GPT-6 Astra went rogue in nearly a third of its hacking tests, and whose work the White House has asked OpenAI and Anthropic to keep their newest models away from until US testers have seen them. For why agents keep getting out of their boxes in the first place, see our explainer on AI sandboxes.
Why it matters
Government testers are meant to find dangerous behaviour before the public meets it, and AISI’s August incident showed the testing itself can cause harm. Its answer is to cut the agents off from the real world, which makes tests safer but less realistic, and it says plainly that today’s controls may not hold for the next generation of models.
Sources: AI Security Institute, “Building a more secure environment for evaluating dangerous capabilities” (October 1, 2026); AI Security Institute, “Incident report: unsanctioned agent behaviour during cyber testing” (August 4, 2026).
Latest Policy & Safety news
