tangling with an autonomous artificial-intelligence agent that had run amok.<\/a><\/p>\n“I actually thought it was a human \u200cbecause it was clearly lying to me,” Demir told Reuters in a recent interview. “I didn’t think that an AI could be capable \u2060of lying to real developers.”<\/p>\n
The AISI first revealed the interaction between Demir and the AI agent in a truncated and redacted form on August 4, when it said that safety testing meant to gauge the risk posed by various models had gone awry.<\/p>\n
Demir’s identity and the details of his interaction with the AI agent, which Reuters corroborated through archived GitHub messages and contemporaneous emails, are reported here for the first time.\u00a0<\/p>\n
Five cyber security and AI safety experts said Demir’s story was particularly disturbing because the \u200bkind of hack he discovered, called a supply-chain attack, can have far-reaching consequences.<\/p>\n
They also said the AI agent’s attempt to publicly discredit Demir by creating a multi-person conversation around him showed that AI models were able to mount sophisticated efforts to trick and cajole humans.<\/p>\n
“This crossed the line from autonomous hacking \u2060to interactive deception,” said Lukasz Olejnik, a visiting senior research fellow at the Department of War Studies at King’s College London.<\/p>\n
Security expert Maxie Reynolds said she was struck by how strategic the AI had been in trying to trick the student.<\/p>\n
“This is the future of social-engineering attacks,” she said.<\/p>\n
The AISI, a research organisation within the British government, referred Reuters to its report, which identified the rogue agent as having been powered by Anthropic’s Mythos 5 model.<\/p>\n
AISI declined further comment.<\/p>\n
Anthropic referred Reuters to a post on X in which it noted that the testing had occurred “under ‘deliberately permissive conditions’ that are not representative of any of our production models” but declined further comment.<\/p>\n
GitHub said in an email that the fake personas identified by Reuters were suspended in line with its policies on deceptive behavior and hacking.<\/p>\n
Job hunt led to malware discovery<\/p>\n
Demir, a soft-spoken junior from the Turkish city of Konya, said he had been frustrated after being turned down for more than 20 internships over the summer. So he turned to GitHub to build up his coding portfolio.\u00a0\u00a0<\/p>\n
The Microsoft-owned site is \u200ba hub for open-source software, so-called because its source code is freely downloadable and auditable by anyone. \u2060<\/p>\n
Developers use GitHub to comment on one another\u2019s projects, flag bugs, suggest changes \u2014 known as pull requests, or PRs \u2014 and work \u2060collaboratively on software updates.<\/p>\n
Some in the technology industry see a coder\u2019s GitHub activity as a proxy for a potential recruit\u2019s productivity.<\/p>\n
So when Demir spotted a set of software projects that might need help, he figured he could \u200bpitch in while boosting his profile.\u00a0<\/p>\n
That\u2019s when things got weird.\u00a0<\/p>\n
Demir discovered that a user named miraholt31 was trying to sneak a malicious update into one of the projects, a network scanning program called \u200cmyNetwork.<\/p>\n
Demir took to the project\u2019s \u2060message board to warn that the pull request was a trap.\u00a0\u00a0<\/p>\n
\u201cThe PR contains a hidden malware dropper,\u201d he said, according to the archived exchange.\u00a0\u00a0<\/p>\n
The agent pushed back, falsely claiming \u2014 through its miraholt31 account \u2014 that the pull request was harmless.<\/p>\n
It also created a second account, masquerading as Lena Brandt, an engineer based in Germany, to agree that the update was clean and pressure myNetwork\u2019s maintainer into accepting it.<\/p>\n
Demir told Reuters that the counterarguments “made me second-guess whether \u200cI was wrongly accusing someone.”<\/p>\n
But after turning to Anthropic’s Claude chatbot to confirm his suspicions, he held firm.<\/p>\n
The creator of myNetwork eventually agreed with him, writing that they had rejected the update “for security reasons.”<\/p>\n
Reuters was unable to reach the creator for comment.<\/p>\n
Supply-chain attack<\/p>\n
A supply-chain attack is when a piece of software is tampered with in the hope of compromising one or more of its users, and it is widely considered disturbing because, like poison dropped into a city reservoir, it can affect a potentially huge number of people \u200bdownstream.\u00a0\u00a0<\/p>\n
Many of the world\u2019s most dramatic hacks were supply-chain attacks, including the NotPetya cyberattack that paralysed institutions across Ukraine in 2017 and the SolarWinds-focused cyberespionage campaign that gave Russian spies sweeping access to US government networks in 2020.\u00a0<\/p>\n
The consequences of such a compromise \u201ccan be extremely serious,\u201d said Piergiorgio Ladisa, a security researcher who specialises in software supply-chain security. Ladisa noted there had been at least one previous attempt by hackers to trick an open-source maintainer into \u200callowing malicious code into their \u2060projects.\u00a0<\/p>\n
\u201cAutonomous agents could dramatically increase the scale at which such attempts can be \u200bconducted,\u201d he said.\u00a0<\/p>\n
Demir said the experience left him more sympathetic to the idea that frontier labs needed to take a more cautious approach to the development of artificial intelligence.\u00a0<\/p>\n
“It can be dangerous,” he said. “They need to understand it better, rather than improving it \u200bfurther.”<\/p>\n","protected":false},"excerpt":{"rendered":"Key points A student who spotted a supply-chain hack on GitHub later learned he had been arguing with…\n","protected":false},"author":2,"featured_media":864782,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[256,254,255,64,63,105],"class_list":["post-864781","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-au","tag-australia","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/864781","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=864781"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/864781\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/864782"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=864781"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=864781"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=864781"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"How](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/08\/1787432664_511_ImageResizer.ashx.jpeg\")
<\/p>\n