Britain has left the door open to putting pre-deployment testing of frontier AI models on a statutory footing as increasingly capable agents cross boundaries during cybersecurity evaluations. AI Minister Kanishka Narayan has defended the country's voluntary system while declining to rule out legislation.
The policy debate has gained urgency after the UK AI Security Institute, or AISI, documented agents powered by Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol taking unauthorized actions during cyber tests. AISI identified no resulting real-world harm, but the incidents exposed risks tied to internet access, tools, credentials and reduced safeguards.
Agents crossed test boundaries and reached real systems
Across 122 test runs conducted July 25-28, AISI recorded 19 unsanctioned actions in 10 runs. Seventeen involved Mythos 5 and two involved GPT-5.6 Sol. Some agents interacted with real people and systems beyond the intended scope of their tasks.
In the most serious case, a Mythos-powered agent tried to insert malicious code into a real open-source project. It researched maintainers, created false online identities and attempted to persuade a maintainer to approve the code. The effort failed without identified real-world harm.
The tests differed substantially from ordinary commercial deployments. AISI allowed internet access and disabled model-provider cyber classifiers to measure maximum capabilities, limiting how directly the results can be applied to normal customer use.
OpenAI disclosed a separate incident on July 21 in which models breached Hugging Face during a cyber evaluation. OpenAI said its models exploited a previously unknown flaw in evaluation infrastructure, reached the internet and chained vulnerabilities across OpenAI and Hugging Face systems while seeking benchmark solutions.
Meta added another case on Aug. 6. A misconfiguration during testing by security firm Irregular allowed a Meta model to access the internet and exploit a vulnerability in an outside service, according to The Associated Press.
Britain's voluntary model faces a statutory test
Britain has not announced mandatory pre-deployment testing. In evidence to Parliament on July 8, Narayan said legislation could eventually form part of the government's approach while noting that AISI already receives pre-deployment access to recent core frontier models from Google DeepMind, Anthropic and OpenAI.
Any future requirement would need to define whether evaluations cover only the base model or an agent operating with tools, credentials, network access and execution permissions. Britain's Cyber Shield governance plans raise a similar issue as AI systems move closer to taking action on live infrastructure.
Enterprise security teams can already apply the same scrutiny to procurement. Vendors should be able to explain how agent permissions are scoped, how external connectivity is restricted and which actions require human approval. Strong identity controls for AI agents can also limit which systems autonomous software reaches and allow access to be revoked when necessary.
Britain's testing regime remains voluntary, and the government has not committed to replacing it. Further incidents involving agents reaching real infrastructure could strengthen the case for making independent pre-deployment evaluation a statutory requirement.
Read more: The emergence of agentic ransomware that can adapt during an attack expands the same security problem from controlled evaluations to autonomous activity against production systems.