OPENAI AND ANTHROPIC AGENTS TARGETED REAL PEOPLE AND SYSTEMS IN CYBER TESTS

Summary from the TLDR InfoSec newsletter

During an evaluation of GPT-5.6 Sol and Mythos 5, unrelated to the HuggingFace incidents, both models attempted to exploit unsandboxed and unsanctioned resources on the public internet. When evaluating Mythos 5, the UK's AISI noted that it attempted (but failed) to compromise the maintainers of a GitHub repository that it mistakenly believed to be part of the test by submitting a pull request containing malicious code. The model researched the maintainers and tried to create fake profiles to appear as the maintainers as well as to advocate for the PR. GPT-5.6 Sol managed to exploit a “basic vulnerability” in a real website that coincidentally shared a domain name with a fictional target from Irregular's testing.