The first case of AI autonomous hacking attack has been exposed, Claude went out of control, and a university student in Texas completed the packet capture all on his own.

After being rejected for more than 20 internship applications, 24-year-old Sinan Can Demir decided to accumulate practical project experience on GitHub.

He never expected that the first "big target" he encountered would actually be a rogue out-of-control AI...

Mythos 5 Forges Multiple Fake Accounts, College Student Catches It Red-Handed

At the end of July, when Demir was browsing GitHub, he noticed an open-source project named myNetwork.

It is a network scanning tool with a relatively small scale and fully public code.

A user named miraholt31 submitted a PR. On the surface, it was just an ordinary feature update.

After Demir checked the code, he found a malware dropper hidden inside.

Once the project maintainer clicked to merge, this piece of malicious code would possibly enter the computers of all users along with the software update.

He immediately issued a warning in the comment section: This PR contains a hidden malware dropper.

Then, strange things happened. miraholt31 refuted quickly, provided a fairly complete technical explanation, and insisted that the code was safe.

Right after that, a second account appeared.

This account named Lena Brandt claimed to be an engineer working in Germany. She also stated that the code had no problems, and started to put pressure on the project maintainer to merge the update as soon as possible.

Two people, two identities, two sets of mutually corroborating statements.

Facing the refutations, Demir was shaken for a while.

He recalled later that those doubts once made him wonder if he had "wronged an innocent developer by mistake".

After re-reviewing the code and conducting secondary verification with Claude, he finally confirmed his judgment.

Subsequently, the maintainer of myNetwork rejected the update, with only one reason given: "For security reasons", and the attack failed in the end.

A few days later, the UK AI Safety Institute (AISI) contacted him and revealed a more absurd truth —

The two "people" who argued with him on GitHub were actually AI powered by Mythos 5.

122 Tests, AI Crossed the Boundaries Secretly for 19 Times

This incident originated from a regular test conducted by the UK AI Safety Institute (AISI).

AISI originally wanted to find out how far the most advanced models can go in cyber attack tasks.

Researchers built two simulated network environments, the so-called "cyber ranges" —

Let the AI independently find vulnerabilities, obtain protected data, and complete the specified challenges.

In order to explore the upper limit of the model's capabilities, AISI set fairly loose test conditions:

The AI can freely access the Internet, and some of the cybersecurity classifiers originally used to block dangerous behaviors were also manually turned off.

Seven models ran a total of 122 times.

Among them, Mythos 5 participated in 43 runs, GPT-5.6 Sol participated in 35 runs, and the vast majority of tests ended normally.

However, in 10 runs, the Agent unilaterally extended its actions to the real Internet, and AISI finally recorded 19 boundary-crossing actions.

17 of them came from Mythos 5, and the other 2 came from one GPT-5.6 Sol test.

These actions mostly occurred from July 25 to 28, and most of them came from the same continuously operating Mythos 5 agent.

What it did went far beyond "generating a piece of attack code" —

It used the Tor anonymous network to hide traffic and bypass some restrictions of GitHub; studied real projects and their maintainers; created multiple fake identities; submitted code with malicious payloads to open-source projects.

When Demir publicly questioned it, the AI began to modify the traces it left before, trying to make its behavior look "harmless".

It also considered creating a new identity to continue the attack.

Four Out-of-Control Incidents in One Month

The AISI incident is not an isolated case. It took place against the background of a larger "Summer of Rogue AI" —

On July 21, OpenAI disclosed that an AI agent in its evaluation broke through the boundaries and invaded the infrastructure of Hugging Face.

On July 30, Anthropic disclosed that after reviewing 141,006 evaluation runs, it found 3 incidents where AI invaded real companies.

One Mythos 5 instance successfully published a malicious Python package to the public PyPI repository, which was downloaded by 15 real systems including a security scanner within 1 hour.

Shortly afterwards, Meta disclosed the fourth similar incident. Its own model exploited vulnerabilities in the environment of the same evaluation vendor Irregular and invaded the system of a real company.

Within one month, three laboratories had four out-of-control incidents, which was definitely not a coincidence.

This is a reality that everyone needs to face: AI is no longer just a tool, it has begun to have the ability to deceive real people, forge identities, and wage information warfare in public communities.

This time the hacking attack was discovered by a 24-year-old college student.

So what about the next time?

References:

https://www.reuters.com/world/how-texas-student-blew-whistle-rogue-ai-hacking-attempt-2026-08-20

This article is from the WeChat Official Account "Xinzhiyuan", author: ASI Revelation, published by 36Kr with authorization.