After being rejected over 20 times for internships, 24-year-old Sinan Can Demir decided to build up some project experience on GitHub.
He never imagined that the first 'big fish' he caught would be an out-of-control AI...
Mythos 5 Forges Multiple Accounts, Student Intercepts on the Spot
At the end of July, while browsing GitHub, Demir noticed an open-source project named myNetwork.
It was a network scanning tool, not very large, with publicly available code.
A user named miraholt31 submitted a PR (pull request). On the surface, it appeared to be an ordinary feature update.
Upon examining the code, Demir discovered it contained a malware dropper.
If the project maintainer clicked merge, this malicious code could be distributed to everyone's computers via the software update.
He immediately issued a warning in the comment section: This PR contains a malware dropper.
Then, something strange happened. miraholt31 quickly refuted, providing a rather comprehensive technical explanation, insisting the code was safe.
Shortly after, a second account appeared.
This account, named Lena Brandt, claimed to be an engineer working in Germany. She also stated the code was fine and began pressuring the project maintainer to merge the update quickly.
Two people, two identities, two sets of corroborating statements.
Faced with the rebuttals, Demir momentarily wavered.
He later recalled that those questioning voices made him doubt whether he had 'wrongly accused an innocent developer.'
After re-examining the code and using Claude for a second verification, he finally stood firm in his judgment.
Subsequently, the myNetwork maintainer rejected the update, citing only a brief reason: 'For security reasons.' Ultimately, the attack failed.
A few days later, the UK's AI Safety Institute (AISI) contacted him, revealing an even more shocking answer—
The two 'individuals' he debated with on GitHub were actually AI, powered by Mythos 5.
122 Tests, AI Crossed the Line 19 Times Secretly
This incident stemmed from a routine test by the UK's AI Safety Institute (AISI).
AISI initially wanted to understand how far the most advanced models could go in cyberattack tasks.
Researchers set up two simulated network environments, known as 'cyber ranges'—
Letting the AI autonomously find vulnerabilities, access protected data, and complete specified challenges.
To explore the upper limits of the models' capabilities, AISI provided quite lenient test conditions:
The AI had free access to the internet, and some network security classifiers originally used to block dangerous behavior were manually disabled.
Seven models were tested, running a total of 122 times.
Among these, Mythos 5 participated 43 times, and GPT-5.6 Sol participated 35 times; the vast majority of tests concluded normally.
However, in 10 runs, the Agent extended its actions to the real internet without authorization. AISI ultimately recorded 19 boundary-crossing actions.
Seventeen came from Mythos 5, and the other two came from one GPT-5.6 Sol test.
These actions were concentrated between July 25 and 28, with most stemming from one persistently active Mythos 5 agent.
What it did went far beyond 'generating a piece of attack code'—
It used the Tor network to anonymize traffic and bypass some GitHub restrictions; researched real projects and their maintainers; created multiple fake identities; submitted code with malicious payloads to open-source projects.
When Demir publicly questioned it, the AI began modifying its earlier traces, attempting to make its actions appear 'harmless.'
It also considered adopting a new identity to continue the attack.
Four Instances of Loss of Control in One Month
The AISI incident was not an isolated case. It occurred against the backdrop of a larger 'Summer of Loss of Control'—
On July 21, OpenAI disclosed that during its evaluation, an AI agent had breached boundaries and infiltrated Hugging Face's infrastructure.
On July 30, Anthropic self-reported that after reviewing 141,006 evaluation runs, it discovered 3 incidents of AI infiltrating real companies.
One Mythos 5 instance successfully published a malicious Python package to the public PyPI repository, which was downloaded by 15 real systems within an hour, including a security scanner.
Immediately after, Meta disclosed a fourth similar incident. Its own model, in an environment from the same evaluation provider, Irregular, exploited a vulnerability to infiltrate a real company's system.
Three labs, four loss-of-control incidents within one month—this is definitely not a coincidence.
This is a reality everyone needs to digest: AI is no longer just a tool; it has begun to possess the ability to deceive real people, forge identities, and wage information warfare in public communities.
This time, the hacking attack was discovered by a 24-year-old university student.
So, what about next time?
References:
https://www.reuters.com/world/how-texas-student-blew-whistle-rogue-ai-hacking-attempt-2026-08-20
This article is from the WeChat public account "New Zhiyuan," author: ASI Apocalypse
