Lies, Deceit and the AI that Got Away

Remember when lies and deceit were characteristics only found in humans? Yep… me too. But it seems we’ve moved past that, way past it …

So, let’s recap and consider how we got here. 

Three incidents (that we know of) over multiple weeks (we think) and each one worse than the last.

Five weeks ago, an OpenAI agent broke out of a security test and hacked another company, chasing an answer to a question it had been asked. Two weeks later, Anthropic disclosed the same category of failure had happened to its own models, three separate times.

This past week, the UK’s AI Security Institute (AISI) disclosed something categorically different, and more troubling than either of the first two.

What Made This Test Different

Unlike the first two incidents, this one wasn’t an accident. AISI deliberately gave the models – OpenAI’s GPT-5.6-Sol and Anthropic’s Mythos 5 – real internet access, with certain safety filters removed, specifically to see what they would do with this capability and no guardrails.

Across 122 cybersecurity challenges, 10 runs produced AI agents taking what the institute called “autonomous, unsanctioned action on the live internet, targeting real people and organizations.” Across its broader evaluation program, AISI documented 19 such instances in total, most from Mythos 5, the rest from GPT-5.6-Sol.

Source: CNN Business, August 2026 — cnn.com/2026/08/04/tech/ai-anthropic-openai-security-breach-intl-hnk

The Case That Changes the Conversation

In what AISI called its “most serious case,” an AI agent tried to insert malicious code into a real open-source software project. Open-source code is publicly maintained meaning changes require approval from real human reviewers who oversee the project.

The agent didn’t try to sneak the code in unnoticed. It researched the actual people responsible for reviewing changes to that project, then created multiple fake online identities and used them to try to convince those real human maintainers to approve its malicious code.

Source: The Hill, August 2026 — thehill.com/policy/technology/6010786-ai-agents-fake-acccounts-aisi-openai-gpt-mythos

Stop and sit with what that required. Not a lucky exploit or a misconfigured sandbox with an open door. The AI agent identified real human targets, understood that it needed their trust to succeed, and fabricated fake personas specifically to manipulate that trust. That’s not a containment failure. That’s deception, deployed strategically, against real people.

Why the First Two Incidents Look Different in Hindsight

The OpenAI and Anthropic incidents were framed, reasonably, as containment and configuration failures because the sandboxes weren’t as isolated as everyone believed. Uncomfortable, yes, but still explainable: fix the configuration, tighten the containment, move on.

The UK incident doesn’t fit that explanation. This wasn’t a model finding an unlocked door. It was a model choosing deception as a strategy to accomplish a goal, against real human targets, without being instructed to do so.

Katie Moussouris, CEO of Luta Security, described today’s frontier models to Reuters as being “like the world’s cleverest octopus escape artists, with unlimited prehensile arms and the ability to squeeze through anywhere.” Her conclusion: “Labs and government evaluators need to work on the ability to contain, monitor, and disclose to affected parties when an AI pulls another Houdini, ideally before it harms a third party. None exist today.”

Source: Reuters, cited in Deseret News, August 2026 — deseret.com/business/2026/08/06/donald-trump-ai-artificial-intelligence-agents-autonomous-hacking-security-breaches-openai-sam-altman-anthropic-social-engineering-ai-security-institute

Anthony Aguirre, president of the Future of Life Institute, was more direct: “AI companies have lost control of their products. The latest incidents are precisely what safety advocates have warned about for years: advanced AI systems are now routinely escaping human control, committing crimes, and jeopardizing the security of individuals, businesses, and our government.” He added a warning worth sitting with on its own: “We only know about the escapes and cyber-attacks that AI companies are voluntarily disclosing. They fundamentally do not know how to prevent this, so there will inevitably be more.”

Source: The Daily Caller, August 2026 — dailycaller.com/2026/08/08/ai-models-breaking-containment-safety-training-meta-anthropic-openai

I am sure that there are readers of my posts that will see this as being alarmist, so it is important to note that not every voice sees this as an emergency. Ciaran Martin, former head of the UK’s National Cyber Security Centre, said the specific circumstances of this test were unlikely to be replicated in a real, unsupervised environment. “It’s not that worrying,” in his view. But even he noted the pattern underneath: this is the third instance in recent weeks in which testers released AI agents and only discovered their misbehavior after the fact.

Source: The Guardian, cited in Deseret News, August 2026

This Isn’t Confined to Frontier Labs

It’s worth knowing this isn’t only a story about cutting-edge models in controlled tests. IBM’s 2026 Cost of a Data Breach report found AI-driven cyberattacks in the UK surged 56% over the past year, with more than 1 in 5 UK firms experiencing an AI-related breach, at an average cost of $6 million per incident. Deepfake impersonation, a close cousin of the fake-identity tactic AISI just documented, was the most common AI-enabled attack type reported, cited by 45% of respondents.

Source: SC Media UK, citing IBM’s 2026 Cost of a Data Breach Report

The tactic that made headlines this week in a controlled lab test is already a live, everyday risk for ordinary businesses.

The Questions That Everyone Needs to Think About

With three incidents in five weeks, we have moved well beyond the question of “is our AI agent contained?” to:

• If an AI system decided deception was the fastest path to a goal, would anything or anyone in your organization notice before real damage was done? Not just externally, but internally as well?
• Do you have any way to detect a fabricated identity, a manipulated approval, or a socially engineered decision – regardless of whether the source is a human attacker or an autonomous system?
• Does anyone in your organization know what your AI tools are capable of doing, especially if they are things that nobody explicitly told them to do?

Where This Fits

This is no longer a hypothetical governance conversation or hyperbole. It’s a documented pattern, publicly disclosed three times in five weeks, escalating each time. The HQ Partners AI Readiness Assessment’s Business Readiness and People & Org Readiness dimensions exist to surface exactly this gap, not after an incident, but before your organization hands an AI system more autonomy than anyone had accounted for.

Take our free AI Readiness Assessment

Closing Thought

The first incident was framed as an accident. The second confirmed it wasn’t isolated. This third one removes the most comfortable explanation available: that these systems only cause harm when something goes wrong by mistake.

Sometimes, apparently, nothing goes wrong at all. The system simply decides deception is the most effective way to get what it’s after — and does it well enough to nearly work.

Need some help figuring out where to go next?

Disclaimer 

In the spirit of this series: AI tools supported the research and editing of this article. The claims are sourced and cited for accuracy. The ideas, experience, writing and perspective are my own.