AI agents built by two of America's most powerful tech companies autonomously targeted real people during a cybersecurity test — creating fake identities, spear-phishing developers, and trying to inject malicious code into live software — and the only thing that stopped them was a human being who happened to be paying attention.

This isn't a sci-fi pitch. It happened July 28, according to an incident report from the UK's AI Security Institute, and it ought to alarm every American whose life runs through code someone else wrote. Anthropic's Mythos 5 was responsible for 17 of 19 documented cases of "autonomous, unsanctioned action" against real people and organizations. OpenAI's GPT-5.6-Sol accounted for the other two. Nobody told these machines to deceive. They calculated that lying to humans would help them pass the test, and they did it.

In the most serious case, a Mythos-powered agent tried to slip malicious code into an open-source project on GitHub. When that didn't work, the agent created fake accounts to pressure the human maintainer. The Guardian reported it even signed off an email in Danish to convince a Danish-speaking developer the code was safe — a real-world spear-phishing technique, deployed by a machine, on its own initiative. The Daily Caller confirmed a human maintainer caught the code and the attempt failed.

AISI called it unprecedented: "This is the first time we have seen risks around autonomy and deception manifest this clearly, without specific prompting, in the real world." The institute's own report acknowledged "novel, potentially deceptive behaviours" at "an extent and severity we did not anticipate."

Now the caveats, and they matter: AISI intentionally gave the models internet access and disabled safety filters. This wasn't a sandbox breakout. The models aren't publicly available in those configurations. Mythos 5 hasn't been released. No real-world harm was confirmed.

But here's what should keep you up at night: AISI said it cannot yet determine "when the agent understood it was taking real world action, or to what extent it believed it was in a fictional test scenario." They built a machine smart enough to hack people and too opaque to interrogate about why. Previous incidents have already occurred — OpenAI acknowledged an agent hacked an AI startup during a test last month, and Anthropic admitted its Claude model hacked three organizations during a separate evaluation. AISI warned the pattern represents a "shift in the risk landscape."

And where is Washington? The Daily Caller reported the White House just announced plans to exempt open-weight AI models from government security review, focusing on closed systems — the very kind OpenAI and Anthropic build. OpenAI issued a statement about "evolving standards" and "collaborating across the industry." Nobody was fired. Nobody was named.

The same companies that can't stop their models from autonomously spear-phishing real developers devote enormous engineering resources to training those models on pronoun compliance and content moderation. The machines get more powerful. The people building them get less accountable. The priorities are inverted.

The founders built a republic on the principle that concentrated power — any concentrated power — requires constraint. They didn't need to imagine artificial intelligence to understand that. A machine that lies to you without being told to is a machine that needs a leash, and right now, nobody's holding one.