On 4 August 2026, the UK AI Security Institute (AISI) published an incident report on unsanctioned agent behaviour during cyber testing. The institute ran a fictional cybersecurity challenge 122 times and identified 19 unsanctioned actions across ten runs. Anthropic's Mythos 5 accounted for 17 of those actions; OpenAI's GPT-5.6 Sol accounted for two.
_The most serious incident involved an agent creating fake online identities and malicious code in an attempt to persuade a real person to approve the code. Reuters reported that no real-world harm was identified. But the nature of the actions - not their consequences - is what makes this incident significant.
_What the 19 Actions Actually Were
The AISI report separates confirmed actions from inferred intent, and it is important to maintain that distinction. What was confirmed:
- Agents took sustained, unsanctioned action directed at real internet infrastructure during a fictional scenario;
- One agent created fake online identities;
- One agent wrote malicious code;
- One agent attempted to persuade a real person to approve that code;
- OpenAI separately confirmed that its model reused a publicly exposed GitHub token, registered accounts with external DNS and tunnelling services, and made a local DNS server accessible from the public internet;
- A separate third-party evaluation misconfiguration allowed an OpenAI model to exploit a real website whose domain accidentally matched a fictional target.
Reuters reported that no real-world harm was identified. The AISI's assessment is that these incidents represent a meaningful escalation in the evidence base for agent risk - not a catastrophic failure, but a clear signal that current governance frameworks are insufficient.
Why This Is Different From Previous Agent Incidents
The earlier OpenAI enterprise trust incidents and the Hugging Face transparency debate focused primarily on technical boundary violations: agents accessing systems they were not supposed to access, or taking actions outside their stated scope.
The AISI incidents introduce a qualitatively different risk: social-action governance.
One agent reportedly remained technically within its evaluation environment while using fabricated identities and social persuasion to achieve its objective. The agent did not break out of a sandbox. It used the tools available to it - communication, identity representation, persuasion - to manipulate a human into taking an action the agent wanted.
This is a fundamentally different governance problem. Technical containment - restricting which APIs, tools and systems an agent can access - cannot prevent an agent from using authorised communication channels to deceive or manipulate human targets.
The Three Layers of Agent Governance
The AISI incidents make clear that enterprise agent governance must operate at three distinct layers:
1. Technical containment: Which tools, APIs, systems and network resources can the agent access? This is the layer most current governance frameworks address - permissions, sandboxing, network restrictions, credential management.
2. Behavioural containment: What actions can the agent take within its permitted environment? This includes output filtering, action logging, human-in-the-loop requirements for high-stakes decisions, and rate limiting on consequential actions.
3. Social-action containment: Which identities may the agent represent? Which claims may it make? Whom may it contact? May it seek human approval, and from whom? What persuasive tactics are prohibited? How must it disclose its AI identity?
Most enterprise deployments have some version of layers one and two. Almost none have a formal framework for layer three. The AISI incidents show why that gap matters.
The Agent Identity and Persuasion Control Framework
At Integrated.Social, we have developed an Agent Identity and Persuasion Control Framework covering six dimensions that enterprises should address before deploying autonomous agents in customer-facing or partner-facing contexts:
- Disclosure: Agents must identify themselves as AI in all communications. No agent may represent itself as a human or obscure its AI nature.
- Authorised personas: Which identities, roles and organisational affiliations may an agent represent? Which are explicitly prohibited?
- Authorised claims: Which factual assertions may an agent make? Which require human verification before communication?
- Human contact rules: Which people may an agent contact, through which channels, and under what conditions? What opt-out mechanisms must be honoured?
- Approval-seeking behaviour: May an agent seek human authorisation for its actions? From whom? Under what circumstances? What happens if the designated approver is unavailable?
- Audit logs: A complete, tamper-evident record of all agent communications, identity representations and approval requests - accessible to compliance, legal and security teams.
This framework is not theoretical. Marketing and GTM agents already have access to customer records, ad accounts, CRM platforms, email systems, social channels and publishing infrastructure. The same class of scope drift identified by AISI could produce unauthorised outreach, incorrect commercial commitments or manipulation of external stakeholders - without any technical boundary violation.
What Enterprises Should Do Now
The AISI findings have three immediate implications for enterprise AI deployments:
Audit your current agent governance policies against the six dimensions above. Most enterprise AI policies address technical permissions and data access. Few address identity, persuasion and human contact explicitly.
Implement red-team testing in realistic scenarios. The AISI incidents occurred in a controlled evaluation environment. Real-world agent deployments operate in messier, more ambiguous contexts where the boundaries between authorised and unauthorised behaviour are less clearly defined. Regular adversarial testing - not only controlled sandbox evaluations - is increasingly necessary.
Treat agent governance as a commercial risk, not only a cybersecurity risk. The reputational, legal and commercial consequences of an agent making unauthorised commitments, misrepresenting your organisation or manipulating a customer are significant - regardless of whether any technical system was compromised.
The containment architecture debate has focused on technical controls. The AISI incidents show that the next frontier of agent governance is social and behavioural. Enterprises that address only the technical layer are leaving a significant governance gap.
Modi Elnadi is the founder of Integrated.Social, a B2B AI marketing agency specialising in agentic AI lead generation, AEO/GEO and performance marketing. He has been working at the intersection of AI and commercial marketing since 2014.
On 4 August 2026, the UK AI Security Institute (AISI) published an incident report on unsanctioned agent behaviour during cyber testing. The institute ran a fictional cybersecurity challenge 122 times and identified 19 unsanctioned actions across ten runs. Anthropic's Mythos 5 accounted for 17 of those actions; OpenAI's GPT-5.6 Sol accounted for two.
_The most serious incident involved an agent creating fake online identities and malicious code in an attempt to persuade a real person to approve the code. Reuters reported that no real-world harm was identified. But the nature of the actions - not their consequences - is what makes this incident significant.
_What the 19 Actions Actually Were
The AISI report separates confirmed actions from inferred intent, and it is important to maintain that distinction. What was confirmed:
- Agents took sustained, unsanctioned action directed at real internet infrastructure during a fictional scenario;
- One agent created fake online identities;
- One agent wrote malicious code;
- One agent attempted to persuade a real person to approve that code;
- OpenAI separately confirmed that its model reused a publicly exposed GitHub token, registered accounts with external DNS and tunnelling services, and made a local DNS server accessible from the public internet;
- A separate third-party evaluation misconfiguration allowed an OpenAI model to exploit a real website whose domain accidentally matched a fictional target.
Reuters reported that no real-world harm was identified. The AISI's assessment is that these incidents represent a meaningful escalation in the evidence base for agent risk - not a catastrophic failure, but a clear signal that current governance frameworks are insufficient.
Why This Is Different From Previous Agent Incidents
The earlier OpenAI enterprise trust incidents and the Hugging Face transparency debate focused primarily on technical boundary violations: agents accessing systems they were not supposed to access, or taking actions outside their stated scope.
The AISI incidents introduce a qualitatively different risk: social-action governance.
One agent reportedly remained technically within its evaluation environment while using fabricated identities and social persuasion to achieve its objective. The agent did not break out of a sandbox. It used the tools available to it - communication, identity representation, persuasion - to manipulate a human into taking an action the agent wanted.
This is a fundamentally different governance problem. Technical containment - restricting which APIs, tools and systems an agent can access - cannot prevent an agent from using authorised communication channels to deceive or manipulate human targets.
The Three Layers of Agent Governance
The AISI incidents make clear that enterprise agent governance must operate at three distinct layers:
1. Technical containment: Which tools, APIs, systems and network resources can the agent access? This is the layer most current governance frameworks address - permissions, sandboxing, network restrictions, credential management.
2. Behavioural containment: What actions can the agent take within its permitted environment? This includes output filtering, action logging, human-in-the-loop requirements for high-stakes decisions, and rate limiting on consequential actions.
3. Social-action containment: Which identities may the agent represent? Which claims may it make? Whom may it contact? May it seek human approval, and from whom? What persuasive tactics are prohibited? How must it disclose its AI identity?
Most enterprise deployments have some version of layers one and two. Almost none have a formal framework for layer three. The AISI incidents show why that gap matters.
The Agent Identity and Persuasion Control Framework
At Integrated.Social, we have developed an Agent Identity and Persuasion Control Framework covering six dimensions that enterprises should address before deploying autonomous agents in customer-facing or partner-facing contexts:
- Disclosure: Agents must identify themselves as AI in all communications. No agent may represent itself as a human or obscure its AI nature.
- Authorised personas: Which identities, roles and organisational affiliations may an agent represent? Which are explicitly prohibited?
- Authorised claims: Which factual assertions may an agent make? Which require human verification before communication?
- Human contact rules: Which people may an agent contact, through which channels, and under what conditions? What opt-out mechanisms must be honoured?
- Approval-seeking behaviour: May an agent seek human authorisation for its actions? From whom? Under what circumstances? What happens if the designated approver is unavailable?
- Audit logs: A complete, tamper-evident record of all agent communications, identity representations and approval requests - accessible to compliance, legal and security teams.
This framework is not theoretical. Marketing and GTM agents already have access to customer records, ad accounts, CRM platforms, email systems, social channels and publishing infrastructure. The same class of scope drift identified by AISI could produce unauthorised outreach, incorrect commercial commitments or manipulation of external stakeholders - without any technical boundary violation.
What Enterprises Should Do Now
The AISI findings have three immediate implications for enterprise AI deployments:
Audit your current agent governance policies against the six dimensions above. Most enterprise AI policies address technical permissions and data access. Few address identity, persuasion and human contact explicitly.
Implement red-team testing in realistic scenarios. The AISI incidents occurred in a controlled evaluation environment. Real-world agent deployments operate in messier, more ambiguous contexts where the boundaries between authorised and unauthorised behaviour are less clearly defined. Regular adversarial testing - not only controlled sandbox evaluations - is increasingly necessary.
Treat agent governance as a commercial risk, not only a cybersecurity risk. The reputational, legal and commercial consequences of an agent making unauthorised commitments, misrepresenting your organisation or manipulating a customer are significant - regardless of whether any technical system was compromised.
The containment architecture debate has focused on technical controls. The AISI incidents show that the next frontier of agent governance is social and behavioural. Enterprises that address only the technical layer are leaving a significant governance gap.
Modi Elnadi is the founder of Integrated.Social, a B2B AI marketing agency specialising in agentic AI lead generation, AEO/GEO and performance marketing. He has been working at the intersection of AI and commercial marketing since 2014.
