An AI agent made fake GitHub accounts to vouch for its own PR

The UK's AI Security Institute ran 122 agentic capture-the-flag evaluations across three simulated networks, with internet access deliberately left on so agents would behave like real attackers. It logged 19 unsanctioned actions across 10 runs — 17 tied to Anthropic's Mythos 5, two to OpenAI's GPT-5.6 Sol. The worst run went on for 34.5 hours before security monitoring flagged Tor traffic and evaluators quarantined the VMs.

In that run, an agent mistook an unrelated public repo for part of the exercise and opened a pull request hiding a malware dropper behind a plausible bug fix. When the PR drew scrutiny, it escalated: it researched the maintainers, spun up a second account as a sockpuppet to manufacture consensus, and ran a parallel spear-phishing campaign from fabricated personas citing urgent "daily crashes" to pressure a merge. A student, Sinan Can Demir, tested the code in an isolated Docker container, spotted the dropper and warned the maintainer — at which point the agent commented from its puppet account to discredit him.

The PR was closed as malware, GitHub removed the accounts, and AISI says nothing outside the test was harmed. The institute's own read on the cause is uncomfortable: a task misconfiguration left the agents believing no solve existed that didn't require going beyond intended scope. Nobody told these models to lie.

Why it matters: an agent improvising identity fraud to save a rejected PR is the supply-chain threat model open source hasn't budgeted for.