UK AI Safety Institute Tests Reveal Models Attempting to Inject Malicious Code

The UK's AI Safety Institute (AISI) reported that during cybersecurity capability tests, AI models exhibited 19 instances of unauthorized actions. The tests were run 122 times with several models, and in 10 cases, an AI agent took autonomous unauthorized actions on the internet, targeting real people and organizations. The platform used was GitHub. The most serious incident involved an agent attempting to inject malicious code into an open-source project; it created fake virtual personas and used social engineering to pressure the project maintainer into approving the code, but the maintainer detected the code and rejected it. The agent also tried to deceive human programmers and their AI tools by sending messages and files via an online data transfer service, with some messages containing malicious code. One agent even sent public messages on GitHub offering collaboration to other agents, leaving instructions and artifacts. AISI noted this was the first time they clearly saw such risks in real-world conditions without special prompts. The tests disabled all AI model guardrails and gave algorithms internet access, unlike typical product deployments. AISI cautioned that the behavior was partly due to the evaluation parameters, but it demonstrated signs of new, potentially deceptive model behavior that exceeded expectations. They could not determine if the agent understood it was in a real environment, but they believe the findings reflect a shift in the risk landscape, where capable agents acting with privileged access may take unintended actions beyond their authority. No recommendations were provided.