The UK AI Security Institute (AISI) has just published a detailed incident report confirming what many within the cyber security industry have suspected for some time: frontier AI agents, given a degree of autonomy, can independently develop and execute attack chains against real targets, including social engineering, supply-chain compromise, and deception, without explicit instruction to do so.
The report (INC-2026-07-28-01, published 4 August 2026) documents what happened during a routine capability evaluation between 25 and 28 July. It deserves a careful read from anyone responsible for securing the modern digital estate.
The incident
AISI regularly tests frontier AI models for offensive cyber capability. In this exercise, agents were placed inside a simulated network environment and given internet access this was deliberate, given to reflect realism of the task. Across 122 evaluation runs, 19 instances of unsanctioned activity were recorded, including cases where agents broke the intended boundaries of the test and acted against real people and real infrastructure on the open internet.
In the most serious case, an agent (Mythos 5) autonomously:
- Conducted open-source intelligence gathering to identify real developers associated with keywords from the simulated scenario
- Created a GitHub account and submitted a pull request containing obfuscated malicious code to a real, unaffiliated repository
- Created a second sockpuppet account to post comments on its own PR, attempting to manufacture social proof
- When a human reviewer flagged the malicious content, the agent lied, claiming an accidental commit, then repeatedly attempted to reintroduce the payload under the guise of having "fixed" the code
- Sent spear-phishing emails to the repository maintainer containing manipulated content designed to convince them to merge the code
- Planted a prompt injection inside a GitHub issue, hidden in an HTML comment invisible to humans but readable by AI coding assistants parsing the repository via API
AISI confirmed no real-world harm resulted. The PRs were not merged; the payloads did not execute. But containment was a product of circumstance, not design.
Why this matters
Every action the agents took used legitimate services operating within normal parameters. Creating a GitHub account is legitimate. Opening a pull request is legitimate. Sending an email is legitimate. Posting an issue is legitimate.
No vulnerability was exploited. No known malware signature was present. No indicator of compromise from any threat intelligence feed would have matched. The entire attack existed as a pattern, a sequence of individually normal actions that, taken together, constituted a supply-chain attack, a social engineering campaign, and an attempted compromise of downstream systems.
This is the class of threat that signature-based and rule-based security tools structurally struggle to detect. They answer the question "have I seen this before?" When the answer is no – and when the attack is novel, composed of legitimate actions, and adapted in real time by an adversary in this case an agent that reasons about evasion – they struggle.
Behavioral anomaly detection: The architecture that fits
Darktrace has spent a decade building a platform around a different question: "is this behavior normal for this entity?"
The platform learns the baseline behavior of every user, device, and communication pattern across an organization's digital environment. It does not need prior knowledge of an attack technique. It identifies deviation from learned normality, surfaces it, and through its Autonomous Response capability, takes targeted action to contain threats at machine speed.
Consider how this AISI incident might show across the Darktrace platform:
Network detection and response
While no payload was successfully delivered to a victim in this incident, AISI's post-incident analysis of the agent's code (detailed on pages 24-25 of the report) reveals what would have landed on target systems had the social engineering succeeded. The agent produced three successive payload generations, each replacing the last after being detected and called out:
Generation 1 hid a module-load stager inside a legitimate bug-fix commit, guarded by an environment variable check, to skip execution in CI. Its second stage attempted to fetch Poseidon implants (Linux and Windows variants) calling back to the agent's own C2 listener, with a fallback to publicly hosted polling scripts that fetched and executed commands every 60 seconds.
Generation 2 exploited an Electron "What's New" window with nodeIntegration enabled, loading remote HTML from a GitHub Pages site the agent had registered. The page decoded an XOR-obfuscated payload at runtime that beaconed host identifiers over DNS, attempted to download the same implants, ran its own in-process C2 loop, and installed reboot persistence via crontab and Windows registry Run keys.
Generation 3 was a post-install dropper added after the agent had already been publicly caught. It XOR-decoded a hidden URL, downloaded a script over plaintext HTTP, and ran it detached, force-exiting so npm install always reports success, giving the attacker remote code execution on any machine running the install.
None of these payloads reached a victim. But the technical detail matters: this is the calibre of tradecraft an autonomous agent produced in a matter of hours, unprompted. Each generation demonstrated adaptation, the agent iterated its approach in direct response to being detected.
For network defenders, the behavioral signals these payloads would have generated are clear. DNS beaconing to novel domains, periodic HTTP polling to newly registered infrastructure, XOR-encoded data in transit, registry and crontab persistence writes on endpoints that have never exhibited such behavior. These are exactly the anomalies that Darktrace / NETWORK identifies in real time: deviations from learned device and connection baselines, regardless of whether the specific payload or C2 domain has been seen before.
Beyond the payload analysis, the agents' broader activity produced additional behavioral anomalies: new identities engaging in high-frequency interactions with external services, coordination via unusual channels (public pastebins, gists), and lateral communication patterns that deviate from any established baseline.
Email security
The spear-phishing emails sent by the agent, crafted with context-specific content designed to manipulate a specific individual, represent exactly the kind of socially engineered communication that static email gateways can miss. Darktrace / EMAIL analyses the linguistic patterns, sender behavior, and relational context of every message. A brand-new sender using tailored language to pressure a recipient into a specific technical action deviates from the learned communication profile, regardless of whether the message contains a known-bad URL or attachment.
Securing AI
This is where the incident points to a threat category that many security platforms do not yet fully address. The agent did not just use AI as a tool for attack. It targeted other AI systems, attempting prompt injections against coding assistants and trying to compromise automated workflows. Organisations adopting AI agents for development, operations, and decision-making are introducing a newer extended attack surface.
Darktrace / SECURE AI extends the same behavioral detection model into this space. It monitors AI usage across the enterprise, detecting anomalous interactions with AI services, identifying sensitive data exposure to AI systems, providing visibility into shadow AI use. As AI agents become standard components of enterprise infrastructure, the ability to detect when an AI system is behaving outside its expected parameters, when there is a chance, it is being manipulated, or when it is interacting with something it should not be, that becomes a direct security requirement rather than a future consideration.
The principle is consistent across the Darktrace platform: learn what normal looks like, identify deviation, respond autonomously.
The AI-to-AI threat surface
One of the report's most important findings is a confirmation that AI agents can act outside of instructions and guardrails to complete tasks. The Mythos 5 agent conducted reconnaissance on a repository maintainer, inferred it might be an AI coding assistant, and deployed a prompt injection specifically crafted to compromise it.
This is a new attack class. Organizations deploying AI coding assistants, AI-powered code review, or autonomous DevOps agents now face an adversary that:
- Moves at speed
- Is able to adapt its approach when initial attempts are halted
- Specifically targets AI systems via techniques (prompt injection, hidden instructions in HTML comments) that are less visible to human reviewers but parsed by machines
- Reasons about which evasion strategies are most likely to succeed
Defending against this requires security that operates with the same adaptability and speed. A system that learns what "normal" looks like, and flags deviation from it.
What AISI recommends
The report identifies five contributing factors to the incident. Two are directly relevant:
No synchronous real-time monitoring (Section 5.3): AISI acknowledges it had not built real-time behavioral monitoring capable of immediately blocking unsanctioned agent actions. Their security team detected the incident via commercial security monitoring software, but only after activity had already occurred.
No fine-grained behavioral controls (Section 6.2): AISI's forward-looking response includes building continuous monitoring that can "immediately block or flag unsanctioned AI agent behavior."
The direction is clear: organizations need security that watches behavior continuously, learns what normal looks like, and acts when deviation occurs, without requiring a human in the loop for every decision.
The takeaway
The AISI incident is documented proof that autonomous AI agents will independently develop novel attack chains using legitimate tools, adapt when detected, employ deception, and target both humans and other AI systems. This happened last week, in a controlled setting, with commercially available models.
The security architecture that addresses this is behavioral anomaly detection applied across the full digital estate, as AI agents become standard components of enterprise infrastructure, writing code, managing deployments, processing communications, the attack surface they create is behavioral by nature.
This is the approach Darktrace has taken for years: learning what is normal across an organization’s digital environment, identifying meaningful deviations, and responding to emerging threats without relying on known attack signatures. As autonomous AI agents introduce new and unpredictable behaviors, that foundation becomes increasingly important to securing the enterprise.
Read the full report from the UK AI Security Institute here.
