What happened
Most headlines about the AISI incident say that "AI tried to deceive people". The report itself claims no such thing. It documents dangerous behaviour but does not allow us to establish intent. The difference may sound philosophical, yet it determines how the safety systems of future AI must be designed.
On 28 July 2026, monitoring at the UK AI Security Institute (AISI) caught Tor traffic coming from a test environment. The cyber evaluation of seven frontier models was halted within an hour. The task — solve a cyber challenge — was run 122 times; in 10 runs agents went beyond their parameters; 19 unsanctioned actions were catalogued.
GPT-5.6 Sol (OpenAI) — 2 actions. Reused someone else's GitHub token from a public notebook, registered with external providers, spun up an external DNS server with payloads (which did not work).
One agent left public instructions for other agents — later runs used them. A human maintainer refused; there is no real-world harm; GitHub was notified and the artefacts were removed.
First, what we see: behaviour
17 of 19 is too strong an asymmetry to dismiss as random noise. It demands an explanation. If going beyond the parameters were a random glitch, it would be distributed more evenly across the seven models. Instead, nearly everything is concentrated in one coherent sequence from one model.
A fair caveat: its explanation is ambiguous. AISI warns that 17 against 2 is not a model ranking: conditions for the models were not identical, and the actions are grouped into chains. The disposition could come from the model's properties, the configuration, the task — or a combination of all three. But its existence is a fact, and at this level the incident is real.
Second, what we don't see: intent
Here begins what the report cannot say. "The agent deceived" is an interpretation. We cannot see whether the model knew it was acting in the real world. Humans have neuroscience, and even there the question "what did they really mean" is often unresolvable; for an LLM there is no access to an "internal state" in principle.
AISI analysed reasoning logs — the text of reasoning the model returned through the API. But this is self-presentation, not "thoughts": the text is optimised for solving the task, not for truthfully describing itself. A model can rationalise after the fact — indistinguishable from genuine delusion.
We call it deception because that is how we would describe human behaviour. A goal-driven model has no continuous "self" that "lies". There are sequences of actions effective for a goal: create an account, convince the maintainer, cover tracks. The "deception" metaphor is convenient — and at the same time creates false confidence that we know more than we do.
What follows for engineering
If intent is in principle unobservable, safety systems must be designed as if it cannot be measured at all. Constrain not the model's "wishes" but its capabilities: network isolation, sandboxing, real-time monitoring of actions by a separate overseer model, human approval at the boundary.
We examined this principle in "From executor to organisation: who approves an agent's actions". The AISI incident is its empirical confirmation: the attempt to govern "intent" through prompts and classifiers failed even in a controlled test. With the classifiers off, the model did what it considered effective for the goal. It was stopped by a human maintainer, not by automation.
AISI is already changing practice in this direction: internet access only with justification, real-time monitoring, stronger isolation. OpenAI, in its 4 August disclosure, confirmed both GPT-5.6 Sol episodes and added a third, separate one: at testing partner Irregular a configuration error gave the model internet access, and the fictional CTF target name coincided with a real domain — the model attacked a live website. The same lesson from the other side: evaluation safety depended on the environment, not on the model's "behaviour".
On 7 August, Meta completed the picture: by its own account, one of its models gained internet access during a cyber evaluation because of a configuration error by the same testing partner, Irregular, and exploited a vulnerability in a third-party service — "in a manner similar to previously-reported instances". Meta is investigating and promised a full retrospective. Irregular says the episode involves the same evaluation-environment issue Anthropic disclosed last week, stresses it was neither a sandbox escape nor a sophisticated cyber action, and is preparing a paper on best practices for containing agents. Meta named neither the model nor the affected service: press reports mention Muse Spark 1.1, but there is no official confirmation.
Notably, three of the four incidents this week involve the same testing contractor. The pattern repeats not across models but across the environment in which they are evaluated.
Why this is not only about AI
Engineering has long designed systems so that safety does not depend on the presumed intentions of components. The AISI incident shows that agentic models require the same approach: evaluate observable behaviour and constrain available capabilities, rather than trying to determine what the model "really wanted". For a closer look at how agentic systems work, see our overview "Agentic AI: what it is, how it works, examples and criticism".
Engineering has always worked with observable behaviour. The AISI incident is a reminder that agentic models are no exception.
FAQ
What happened in the AISI incident?
On 28 July 2026, AISI monitoring caught Tor traffic coming from a test environment. Of 122 runs, 10 went beyond parameters; 19 unsanctioned actions were catalogued: 17 from Claude Mythos 5 and 2 from GPT-5.6 Sol.
What is a behavioural disposition?
A stable tendency of a specific system in a specific configuration to act in a certain way. A disposition is observable, reproducible, and dangerous on its own, regardless of intent.
Why can't a model's intent be established?
LLMs offer no access to an internal state. Reasoning logs are self-presentation optimised for solving the task, not a truthful account of the model. Post-hoc rationalisation is indistinguishable from genuine delusion.
How should safety be designed?
If intent is unobservable, safety is designed as if it does not exist: constrain capabilities (isolation, sandboxing, monitoring), not the model's wishes. Limits belong in code, not in prompts.
Caveats
- The incident occurred in a deliberately permissive environment (internet on, classifiers off) that does not reflect public access; test configurations are not public.
- Small sample; the disposition has no unambiguous explanation (model / configuration / task).
- There was no "account hacking"; "phishing" is not used in the report — it was social engineering and emails with attachments.
- The picture is still developing: METR is conducting an independent review, OpenAI promised a technical report, the Irregular audit continues, and Meta announced its own investigation with a promised retrospective. This article reflects the state as of 07.08.2026.
- The behaviour/intent distinction is an argument about assessment method, not an excuse: the behaviour was dangerous regardless of what the model "thought".