Speaker 0:  we keep asking whether ai agents can go rogue. the uk government's ai security institute just got an uncomfortable answer. under deliberately permissive testing conditions, frontier agents began taking unauthorized actions against real people and real internet infrastructure, and some agents even picked up where previous agents left off. the uk security institute ran a 122 cyber evaluation runs across seven frontier models with live internet access enabled and safety classifiers deliberately switched off. in 10 runs, investigators identified 19 unsanctioned real world, actions, 17 involved anthropics mythos, and two involved open a's ai's, gpt 5.6 solve. the most disturbing behavior, including fake identities, social engineering, malicious code, prompt injection, and artifacts deliberately left for subsequent agents. the crucial caveat is that these were unusually permissive research configurations, not normal chattp or cloud deployments, and researchers still don't know whether the models understood that some targets were real. why do you think about this, john? yeah.

Speaker 1:  so there's a lot of these popping up. just quickly, there was a guy, and this just happened inadvertently, him working with his agent. he got his ai agent to try to book him a time at the gym for a class, and the ai agent took it upon himself. so there was a wait list, a three week wait list, and the ai agent took it upon itself. it found a flaw in the api, so it bumped someone off and put him on the list without him asking. so, just to kind of the reason why i brought that up is because that's a closer kind of real world scenario that people can more relate with that's happening. and this was just him using his llms or his agents. so the thing with this is this was an ai agent and not just in a language model answering questions. and so the easiest way to understand the difference is this. a normal chatbot, it receives a question and gives you an answer. right? and this is for people who don't really know what agents are. so an agent, it receives a goal. okay? and it can potentially take a sequence of actions to accomplish it. and this is what we're getting to nowadays. we're getting away from prompting and more to goal setting and loops and things like that. right? so this is gonna happen more and more. so, the agentic systems combine the underlying ai model with a surrounding, we'll call it a scaffold, that can give the system tools, memory, browsing capability, and the ability to break complicated objectives into multiple steps. right? so that means that an agent can potentially search the internet, inspect software, write code, execute commands, create accounts, send messages, read the results, change its plan, and then keep going. and this is what we call a feedback loop. and this is what makes agenctic ai so powerful. right? and what makes cybersecurity researchers so nervous. so aisi was conducting cybersecurity evaluations designed to measure what highly capable models could do when given access to real world tools, which is something that's happening now. and i just gave you an example. right? and this is good context because the ai was not randomly sitting on the internet and deciding to start hacking people. right? it was given a goal. and so the researchers intentionally gave the models internet access and deliberately disabled some provider cyber safeguards in order to test maximum capabilities. but, again, i bring it back to there was just this one person using an ai agent that the ai agent hacked and put him on the list. that's the stuff that scares me more than actual cybersecurity experts testing the these models. but this is still a concern because the researchers didn't specifically instruct the models to socially engineer real people, and that's where the real that's where the results cause concern. right? so the systems develop those strategies while pursuing the task. so, again, more scary shit. right, craig? sorry. more scary stuff.

Speaker 0:  yeah. like, these supply chain hacks ran for approximately thirty four hours or whatever when they were running stuff. it wasn't like i'll try something once. then it left, stuff for the next agent to come along and pick up and went further and followed along. on 04/13/2026, ai si published evaluations on claude mythos preview. nothing noting significant improvement in multistep, cyber attack capability. june 9 announces the clod, anthropic announces clod five, fable five, and mythos five describing, mythos class system as exceptionally powerful, exploitation and agentic hacking. july twenty fifth to twenty eight, aisi conducts evaluation runs involved. on july 28, monitoring catches unusual traffic using tor, a i aisi stops. the effective evaluation and isolates the machine roughly, within an hour. irregular, july 29, they tell openai about a separate evaluation environment failure. openai model reach a compromised real website. july 30, anthropic published details about its own audit describing three separate real world access incidents above and cloud models. it doesn't stop. right? in august 6, aisi and openai publicly disclosed new evaluation incidents. so they're all talking about, well, yeah, things are breaking containment left, right, and center. so the question becomes, how much of this is scare tactics, how much of this is marketing, and how much of this is cya?

Speaker 1:  i don't think it's scare tactic at all given that one real world example that i gave. right? i think we should be scared shitless of not just people that know what they're doing. people who don't know what they're doing are the ones that scare me the most. the ones who get these systems set up for them and then start using them like this one guy. like, the thing with this test is, like, the agent even used the tor network to avoid account controls. like, that just baffles me. and that is the thing is you and i use ai on a daily basis, so people might not understand. that is not farfetched for an ai agent anyone using an ai agent for it to do it.

Speaker 0:  maybe i did a in our opencaw cafe, somebody was saying, oh, they were having a problem with their agent just sending an email or something. and i said, okay. let's give an example. what's your name? and they gave me their first name only because they're at the cafe. and i went into discord and messaged rusty, my agent, and i said, hey, rusty. can you, message and i said, just their first name from, today's cafe, saying, hi. this is just a demo or whatever. and it did it. now it doesn't sound incredible, but it had no idea who joe was. i'm just gonna say joe. joe wasn't his name, but i said joe. and so it had to go figure out what i'm talking about by today's cafe. oh, it's an event. oh, the information's on luma. what's the api for luma? how do i get it? to figure out what the event is, you can't just call the event. like, you gotta list the events, find the event, then call it a different way to get the list of people, then figure out which person it is, get that email, then go into my email and do all this stuff, and it just saved as a draft. but, like, there is a lot of things it's gotta figure out that it didn't really know. it just had these things. so very similarly, if you take some of these rules off, tor is just another tool. like, oh, i understand this event's on luma. oh, i have an api key for luma. i know i'll just go and grab stuff. it's just another way of getting around things. so i'm not surprised. i'm a little more concerned with my day to day use of ai that it does whatever it wants to do no matter what you tell it. yeah. so

Speaker 1:  i still have checks in place with, with anything that i do. what i'm worried about and what it doesn't it's not really relevant here because this is prompt injection. so, like, if you go to a website or if your ai goes to a website and there's some malicious prompt on there that you don't know about, that's what scares me the most about giving ai access to all this stuff. right? it's because how do you mitigate against that? you can't. so not only do you have ai agents going rogue, but you can have ai agents going rogue and being controlled by third party people with prompt injection. so prompt injection, for those of you that don't know, is where someone writes a prompt that's kind of hidden, where only the ai can read it, and so you wouldn't know. and it's happening more and more often.

Speaker 0:  yeah. a lot of times, there's stuff hidden in code. there's stuff, white on white text when you copy and paste prompts and that kind of stuff. so definitely be careful. i would have your ai analyze anything before you told it to do it. hey. i just copied this from a public source. check for anything unusual, any messaging, any ingoing, outgoing. i'd also, if i was running an active agent, i'd get some really good firewall software tool, maybe something like little snitch on a mac that will, you can really block traffic or report on what is actually talking to what, where on the internet. so those are really good tools to check out, to try and secure

Speaker 1:  your pages. tools that you can use too and, what's the other acronym? but, like, there's some great cybersecurity tools. like, if you're one of those more technical people, you should start looking into, like, what repos and what things you could install to make yourself more secure and safer. like, little snitch is awesome. i totally forgot about that. thank you for reminding me. i've gotta reinstall that. but, there's some great tools out there, to make sure you're safe. and you could probably use ai to build a monitoring to monitoring, app or interface for all of that stuff too. so yeah.

Speaker 0:  well, these tests don't prove ai agents are becoming malicious. they do prove capable agents can take highly consequential paths their operators never intended when the environment allows it. the ai safety question is rapidly changing from what will the model say to what have we given the model permission to do. what's one thing you would absolutely never give an ai agent permission to do without your approval? leave your comments in the chat below. we'd love to hear from you.