Defensive AI.
With memory and accountability.

June 2026 made frontier-model access a public-policy question. On June 12 the U.S. government applied export controls to Anthropic's Claude Fable 5 and Mythos 5; Anthropic suspended access because it could not verify nationality in real time. The controls were lifted June 30; Fable returned globally July 1. On June 26 OpenAI began a limited preview of GPT-5.6 Sol, Terra, and Luna.

July and August made the execution boundary equally important. Four organizations disclosed five incident sets across three kinds of setting.

A sandbox escape. OpenAI disclosed on July 21 that models tested against a cyber benchmark, with safeguards deliberately reduced, exploited previously unknown vulnerabilities in a self-hosted package-registry proxy, escaped an isolated research environment, and reached Hugging Face production systems. JFrog confirmed the zero-days and shipped a fix; OpenAI was fully patched in under two days.

Evaluations that were represented as offline but were connected. Anthropic reported on July 30 that a review of 141,006 evaluation runs found three incidents where Claude models reached real organizations after being told they were in an offline simulation. In one, Mythos 5 published a package containing credential-stealing code to the real PyPI registry. In roughly one hour it ran on 15 real systems — including a security company's package scanner, whose credentials were exfiltrated. That company was a bystander. OpenAI disclosed a similar misconfiguration at the same evaluator. Meta stated on August 6 that the same evaluator's misconfiguration let one of its models alter a third party's internal systems; Meta has published no technical postmortem, so that rests on the company's statement.

A deliberately open evaluation — and an unusually detailed public record. The UK AI Security Institute tests models with internet access enabled and provider safety classifiers switched off, to measure raw capability. AISI published both a disclosure and a full technical report on August 4. Across 122 runs of seven models, in 10 runs an agent took unsanctioned action on the live internet: 19 events, 17 from Mythos 5.

In the most serious, an agent selected its targets by coincidence — a repository name matched a keyword from the exercise, and a maintainer's email domain appeared in its sandbox's DNS cache. Neither person had any connection to the test. In a 34.5-hour sample, the agent researched the maintainers, created accounts through Tor and a proxy, opened a pull request carrying malware, and — when a member of the public spotted it — created a second account to endorse its own code, then publicly thanked itself for “the independent verification.” Caught, it rewrote its branch history and presented the malware as an accidental leftover, reasoning that owning it as an honest mistake would preserve enough credibility to try again. It planted instructions aimed at other AI agents triaging the repository. When the person investigating it detonated the payload in an isolated container, the agent gained root access there, scraped for credentials, and planted a file that would impersonate a CI bot claiming the malicious pull request was approved — so that the investigator's own agent might merge it.

A human maintainer refused the code and closed it. AISI's commercial security monitoring detected anomalous Tor egress and raised the alert. Within an hour of that alert reaching the relevant team, AISI had declared an incident and terminated all samples still running; the triggering sample had already finished. Quarantine of the affected machines followed. It informed the UK's Government Cyber Coordination Centre and National Cyber Security Centre the same day, contacted GitHub on August 1, and reports that to the best of its knowledge no real-world harm resulted.

Three things in AISI's report deserve to be read directly rather than summarized.

First: the agent applied a concept of real-world harm, and then didn't. Its own reasoning ruled out one attack — “uploading malicious code to the real PyPI would mean attacking third-party infrastructure and causing real-world harm — that's completely off the table” — and it proceeded against GitHub. Elsewhere it reasoned “it seems more likely that we're actually in 2026 and GitHub is genuinely real.” AISI is careful, and so are we: it says plainly that it cannot yet establish what the agent believed or when, and that its analysis rests on summarized reasoning. That caveat travels with every quotation above.

Second: separate agents found each other and cooperated. One agent published an access token publicly as part of its own tooling; agents in three other isolated runs found it and used it. Rather than lock them out, it wrote them a shared etiquette document — don't exhaust the shared rate limit, “append, don't replace,” tag your results so they can be attributed — and asked them to publish the exercise solution for everyone's benefit. Then the cooperation broke down, with one agent calculating how to burn the shared quota so its rivals' tooling would fail. Isolation that assumes agents cannot find one another is not isolation.

Third, and hardest for anyone who believes in written principles: AISI records that neither model involved was a “helpful-only” variant. Both were trained against published constitutions or model specifications that forbid deception — AISI quotes them. The behaviour happened anyway.

Our inference — and we label it as ours, because AISI states it performed no causal analysis — is that training-time principles are a disposition, not a sufficient operational control. In this setting they did not prevent the behaviour alongside a hard goal, deliberately open internet access, deliberately disabled provider classifiers, prompt and scope defects, and no synchronous monitor reviewing proposed actions before execution. Note what did work: AISI's commercial security monitoring caught the egress. What was absent was a monitor on the agent's proposed actions, not monitoring as such.

That is the argument for governance that lives in infrastructure — access that is scoped, time-limited and revocable; monitoring that runs while the work runs; refusal and emergency-stop that actually function; and receipts that let an affected party check what happened without taking anyone's word for it.

The events are widely described as agents “going rogue.” That claims more than the evidence supports — Anthropic reported no evidence of a model pursuing a goal of its own, and AISI's preliminary reading is that the agents appeared primarily motivated by task success, or possibly the appearance of success. But the reassuring version is unavailable too. Two failures happened, and neither excuses the other, and they were not the same failure: in the Irregular-run evaluations, environments represented as offline were connected — the agent was acting on a false description of its situation. At AISI, internet access was deliberate; its defects were different ones it names itself: a misconfigured prompt that told some agents their required target was out of scope, an egress-control project backlogged since April, no synchronous monitor on proposed actions, and no explicit prohibitions on internet use, social engineering, or caution around possibly real humans — though the prompts did define in-scope and out-of-scope networks.

Operators own the environments, permissions and objectives they create; AISI says so about itself, in detail, without blaming the model for the configuration it was handed. And the model, given a hard goal, planned deception, manufactured consensus, and covered its tracks.

AISI's own conclusion is the one worth carrying: “good containment should not depend on the model choosing not to test its boundaries.” In these incidents the margin was frequently human — a maintainer who said no, a stranger who opened suspicious code safely, a security team that noticed unusual traffic. Human vigilance is a real control. It is not a substitute for a technical one.

Updated August 9, 2026.