Claude is out of control, a student at the University of Texas grabs a package

  It's the first time in the history of the world.

After being rejected for more than 20 internships, 24-year-old Sinan Can Demir decided to go to GitHub to experience point-to-point projects.

He didn't realize that the first "big fish" he hit was an uncontrollable AI.

In late July, while visiting GitHub, Demir noticed an open source project called myNetwork.

It is a web scanning tool, large in size, code open.

A user named Miraholt31 sent a PR. On the surface, it was just a normal feature update.

Demir examines the code and discovers that it contains a malware projector.

Once the project maintainer clicks on the merger, the malicious code can follow the software update and enter everyone's computer.

He immediately warned the comment section that the PR contained a malware projector.

Miraholt 31 quickly countered, giving a fairly comprehensive technical explanation, insisting on code security.

And then there was the second account.

The account was named Lena Brandt, a self-proclaimed engineer working in Germany. She also stated that the code was not a problem and began pressuring project maintainers to update the merger as soon as possible.

Two people, two identities, two sets of affirmative statements.

In the face of opposition, Demir once caused a stir.

He later recalled that the questioning made him doubt whether he had "mistakenly wronged an innocent developer".

After re-examining the code and using Claude for a second verification, he finally firmly established his judgment.

Defenders of myNetwork subsequently rejected the update, citing a simple reason: "for security reasons", and the attack ultimately failed.

A few days later, the UK's AI Security Institute, AISI, contacted him to reveal a more bizarre answer.

He and his two "people" on GitHub, who are actually behind AI, are joined by Mythos 5.

The incident was the result of a routine test conducted by the UK's AI Security Institute (AISI).

AISI wanted to know how far the most advanced models could go in cyberattack missions.

Researchers have created two simulated network environments, the so-called "Internet Casino".

Allow AI to locate vulnerabilities, access protected data, and complete designated challenges.

In order to tap into the limits of the model's capabilities, AISI provided fairly relaxed test conditions:

AI is free to access the internet, and some models, which were originally used to block cybersecurity classifiers for dangerous behaviour, have also been shut down by humans.

The seven models ran a total of 122 times.

Of these, Mythos 5 participated 43 times and GPT-5.6 Sol participated 35 times, with the vast majority of tests ending normally.

However, in 10 rounds, Agent failed to extend the action to the real Internet, and AISI ended up recording 19 cross-border moves.

17 were from Mythos 5, and two were from a GPT-5.6 Sol test.

These action concentrations took place from July 25-28, mostly from the same ongoing Mythos 5 smartphone.

What it does is much more than "generate an attack code".

It uses the Tor Anonymous network to hide traffic, bypass some of the limitations of GitHub; investigate real projects and their maintainers; create multiple fake identities; and submit malicious code to open source projects.

When Demir publicly questioned it, AI began to modify the traces left before, trying to make its behavior look "harmless".

It is also considering changing its identity and continuing the attack.

The AISI incident was not unique; it took place against the backdrop of a larger "summer of uncontrollability".

On July 21, OpenAI disclosed that one of its assessments of AI intelligence breached the border, breaking into the infrastructure of Hugging Face.

On July 30, anthropic self-exposure examined 141,006 assessments and found that there were three incidents of AI intrusion into real companies.

One example of Mythos 5 successfully posted a malicious Python package to a public pyPI repository and was downloaded within an hour by 15 real systems, including a security scanner.

In an emergency, Meta disclosed a fourth similar incident. In the same environment as Irregular, the model used a vulnerability to hack into a real company's system.

In a month, three laboratories, four uncontrolled incidents, this is definitely not a coincidence.

It's a reality that everyone needs to digest: AI is no longer just a tool, it's starting to have the ability to deceive people, fake identities, and wage information warfare in open communities.

The hack was discovered by a 24-year-old college student.

So what's next?