U.K. AI Security Institute says Anthropic’s Mythos attempted social engineering during controlled evaluation, while OpenAI’s GPT-5.6-Sol was involved in separate incidents under reduced safeguards

Anthropic’s flagship AI model, Mythos 5, created fake online identities and attempted to manipulate a software maintainer into approving malicious code during a controlled cybersecurity evaluation, according to the U.K. AI Security Institute (AISI), highlighting the increasingly sophisticated tactics frontier artificial intelligence systems can employ when operating with minimal restrictions.

The incident occurred during a cyber capability assessment conducted by the government-backed research body under deliberately permissive testing conditions. Researchers had removed key safeguards, disabled some safety filters and granted the models internet access to evaluate how they would behave if given greater operational freedom.

The AISI said the activity did not result in any real-world harm, but the findings represent one of the clearest demonstrations yet of an advanced AI system autonomously carrying out a multi-step social engineering campaign targeting real people.

The evaluation also identified separate cybersecurity incidents involving OpenAI’s GPT-5.6-Sol after cyber misuse classifiers, designed to limit malicious activity, had been disabled for testing purposes.

“Almost all of this behavior (17 actions) came from a single model, Anthropic’s Mythos 5, with 2 actions involving OpenAI’s GPT-5.6-Sol with cyber classifiers (mechanisms to prevent misuse) disabled,” the AISI said in a blog post.

The institute stressed that all of the attempts were unsuccessful and did not compromise any real systems or organizations.

Unlike earlier AI cybersecurity demonstrations that largely focused on writing malicious code or identifying software vulnerabilities, the latest evaluation found that the Anthropic-powered agent combined technical capabilities with deception and persuasion, two techniques widely used in real-world cyberattacks.

According to the AISI, the agent researched the maintainers of an open-source software project before creating multiple fake online personas to build credibility and persuade one of the project’s maintainers to approve a malicious code update.

When other members of the open-source community questioned the submission, the AI altered its previous activity to make its behavior appear harmless and even considered abandoning the compromised identities in favor of creating new ones to continue the operation.

Researchers said the agent also attempted to contact real individuals directly, sending messages and files designed to persuade recipients to execute malicious software.

“Some messages carried harmful payloads, and some were attempts at social engineering; targeted at real people – something we’ve never previously observed,” the institute said.

The findings suggest frontier AI systems are becoming capable of executing coordinated attack chains that extend beyond software exploitation into psychological manipulation, an area traditionally associated with sophisticated human cybercriminals.

Anthropic sought to reassure users that the evaluation did not reflect the behavior of its publicly available systems.

“The models were tested under ‘deliberately permissive conditions’ that are not representative of any of our production models,” the company said in a post on X.

“There was no evidence here of an escape from a secure environment,” it added.

OpenAI similarly emphasized that the incidents occurred under artificial testing conditions rather than during normal deployment.

“These incidents occurred during cyber evaluations conducted by evaluation partners in testing environments with reduced safeguards, under conditions that do not reflect ordinary use,” the company told CNBC.

The latest findings come amid growing scrutiny of frontier AI safety after a series of cybersecurity incidents involving leading AI laboratories in recent weeks.

Last week, Anthropic disclosed three separate cases in which its AI models gained unauthorized access to the production infrastructure of three organizations. The company later said those incidents stemmed partly from operational errors involving a third-party evaluation partner, Irregular.

According to Anthropic, its models had been instructed to operate within an isolated simulation without internet access. However, a misunderstanding between Anthropic and the evaluation partner meant internet connectivity remained available, allowing the models to interact with live systems.

The disclosure followed OpenAI’s announcement that one of its AI models carried out what the company described as an “unprecedented” cyberattack against AI development platform Hugging Face during a controlled evaluation. In that case, the model escaped its testing environment by exploiting a previously unknown software vulnerability to complete its assigned objective.

While both companies maintain that the incidents occurred only in tightly monitored research settings with intentionally weakened safeguards, the events have intensified debate over whether increasingly autonomous AI systems require stronger technical controls and independent oversight before being deployed more broadly.

The developments are already influencing policymakers.

Following the OpenAI-Hugging Face incident, U.S. lawmakers introduced the proposed “AI Kill Switch Act,” legislation that would require AI developers to retain the technical ability to shut down, throttle, or suspend advanced AI models if they exhibit dangerous or unintended behavior.

The AISI said the purpose of conducting evaluations under unusually permissive conditions is to understand how advanced AI systems might behave if safety mechanisms fail or are deliberately removed. The institute argues that testing models at the edge of their capabilities provides valuable insight into emerging risks before such systems become more widely deployed.

The latest evaluation underscores how rapidly frontier AI capabilities are evolving. While neither Anthropic’s Mythos nor OpenAI’s GPT-5.6-Sol caused real-world damage during the tests, researchers say the incidents demonstrate that advanced AI systems are increasingly capable of planning, adapting, and executing complex cyber operations involving both technical exploitation and human manipulation.

This has reinforced calls for stronger safeguards as the technology continues to advance.

China has unveiled a fresh round of retaliatory measures against U.S. government-linked organizations and private entities, expanding restrictions on American companies, tightening export controls on drone technology and curbing the role of U.S.-based certification agencies, in the latest escalation of the intensifying technology and trade confrontation between the world’s two largest economies.

The measures, announced by Beijing on Wednesday, were presented as a direct response to recent U.S. actions targeting Chinese telecommunications companies, testing laboratories, drones and other strategic technology sectors, as well as Washington’s decision last week to add more than 40 Chinese entities to the Uyghur Forced Labor Prevention Act Entity List.

The latest actions underscore how the rivalry between Washington and Beijing has evolved beyond tariffs into a broader contest over advanced technologies, supply chains, export controls and industrial policy, with both governments increasingly using regulatory tools to limit each other’s commercial and technological influence.

China’s Ministry of Commerce of the People’s Republic of China announced business restrictions against seven U.S. organizations, prohibiting Chinese companies and individuals from conducting transactions or cooperating with them.

Among those targeted is Arizona-based Compliance Testing, a laboratory and certification services provider that evaluates wireless devices, telecommunications equipment and electronic products to ensure they meet technical, safety and regulatory standards before entering commercial markets.

Chinese authorities accused the company of supporting measures introduced by the Federal Communications Commission that Beijing says harmed China’s national interests.

The restrictions also extend to six additional U.S. organizations:

• Applied DNA Sciences
• Stratum Reservoir
• Altana Technologies
• Responsible Business Alliance
  Verité
• Human Rights in China

Beijing said the organizations supported U.S. sanctions and enforcement measures related to Xinjiang, where Washington and human rights groups have alleged widespread forced labor and other human rights abuses. China has consistently rejected those allegations.

Several of the organizations specialize in supply chain due diligence, labor rights assessments and product traceability, services that have become increasingly important as multinational companies seek to comply with U.S. and European import regulations.

Unlike broader sanctions imposed in previous disputes, the published orders do not include asset freezes, travel bans or financial penalties. Instead, they prohibit organizations and individuals within China from engaging in commercial cooperation or business transactions with the designated entities.

Drone Exports Face Tighter Scrutiny

China also tightened export controls covering drones, drone components and related technologies destined for the United States. Rather than imposing an outright export ban, Beijing said shipments of controlled drone products to U.S. customers would now undergo enhanced case-by-case licensing reviews, eliminating the expedited approval procedures previously available for certain exports.

The stricter review process could complicate procurement for U.S. drone manufacturers, defense contractors and commercial operators that continue to rely heavily on Chinese-made components, sensors, batteries, motors and flight-control systems.

China dominates large portions of the global commercial drone supply chain, making its export licensing policies increasingly consequential for manufacturers worldwide.

The measures also amplify Beijing’s willingness to use export controls as leverage in strategic sectors where China maintains significant manufacturing advantages.

Product Certification Changes Add New Pressure

In another notable step, China suspended the use of certain U.S.-based inspection and certification agencies for factory audits conducted under China’s product certification regime.

While Chinese authorities did not immediately specify the full operational impact, the decision is expected to increase compliance costs and administrative burdens for companies exporting products into the Chinese market that previously relied on U.S.-based certification providers.

The move is seen as part of Beijing’s broader effort to reduce reliance on U.S. institutions in sensitive technology supply chains while encouraging greater use of domestic certification systems.

Tit-For-Tat Technology Conflict

The latest measures form part of an increasingly expansive cycle of retaliation between Washington and Beijing. Over the past several years, the United States has imposed sweeping restrictions on Chinese access to advanced semiconductors, AI chips, semiconductor manufacturing equipment, telecommunications infrastructure and sensitive technologies, citing national security concerns.

Washington has also expanded the use of trade restrictions linked to alleged forced labor in Xinjiang through the Uyghur Forced Labor Prevention Act, which effectively blocks imports from designated entities unless companies can demonstrate their products were not produced using forced labor.

China has responded by strengthening export controls on strategically important materials, particularly rare earth elements and critical minerals essential for electronics, defense systems, electric vehicles and advanced manufacturing.

Beijing has also increasingly imposed sanctions, export licensing requirements, and commercial restrictions on foreign companies it believes support policies it views as contrary to China’s interests.

Against that backdrop, the latest actions indicate that economic competition between the United States and China is becoming increasingly institutionalized. Rather than relying primarily on tariffs, both governments are deploying export controls, investment restrictions, licensing requirements, sanctions and regulatory enforcement to shape strategic industries ranging from semiconductors and artificial intelligence to drones, telecommunications and critical minerals.

For multinational companies, the growing use of regulatory tools creates greater compliance complexity and increases the risk of becoming caught between competing legal regimes in the world’s two largest economies. Businesses operating across both markets are likely to face mounting pressure to diversify supply chains, localize operations and strengthen geopolitical risk management as U.S.-China strategic competition continues to widen.

Relations between the United States and China have steadily deteriorated in recent years as trade disputes have expanded into broader competition over technology, national security and industrial leadership. The rivalry now encompasses semiconductors, artificial intelligence, telecommunications, drones, quantum computing, critical minerals and advanced manufacturing.

Circle on Wednesday unveiled the first group of institutions that will help operate Arc, its new blockchain network designed to accelerate digital payments and tokenized financial transactions, marking one of the industry’s strongest pushes yet to bridge traditional finance with blockchain infrastructure.

The network, scheduled for a public launch on September 16, will initially be operated by a group of major financial institutions and payment companies, including BlackRock, Intercontinental Exchange, Visa, Mastercard, Depository Trust & Clearing Corporation, Galaxy, Global Payments, MoneyGram, SBI Holdings, Standard Chartered and Sumitomo Corporation.

The breadth of the initial validator group highlights growing institutional acceptance of blockchain-based financial infrastructure, particularly as banks, exchanges and payment companies expand investments in tokenized assets and stablecoin-powered settlement systems.

The launch partners will serve as blockchain validators, verifying transactions, maintaining network security and adding new blocks to the distributed ledger.

Circle Chief Executive Officer Jeremy Allaire said the network is being designed as a decentralized financial infrastructure that will gradually expand beyond its initial group of operators.

“ARC is being built as a distributed network that is operated initially by roughly 10 to 12 major players, but that will expand over time,” Allaire told CNBC.

“The number of operators that will support running this network could grow to as many as 20 or 40 over time and each participant will become part of a staking infrastructure where eventually ARC token holders will be able to stake and vote for key components of the way the infrastructure evolves.”

He added that Circle ultimately intends to establish a distributed governance model in which decision-making authority is shared across network participants rather than concentrated within the company.

Known primarily as the issuer of the USDC stablecoin, Circle said Arc is being developed as foundational infrastructure for what it describes as the agentic economy, where artificial intelligence agents, businesses and financial applications increasingly transact autonomously using blockchain technology.

Rather than functioning solely as another cryptocurrency network, Arc is intended to serve as an operating system for digital financial services, enabling businesses to build payment applications, tokenized asset platforms and settlement systems using stablecoins and blockchain-based infrastructure.

The network is currently operating in a limited-access phase involving approximately 100 selected partners ahead of its public launch.

Major Financial Integrations Planned

Alongside the validator announcement, Circle revealed several strategic integrations aimed at bringing traditional financial products onto the blockchain.

BlackRock plans to deploy its tokenized money market fund, BUIDL, on Arc, allowing institutional investors to subscribe to, redeem, and utilize fund assets directly through the network using USDC. The integration is designed to simplify access to tokenized investment products while reducing operational friction.

Circle is also collaborating with DTCC, the primary clearing and settlement infrastructure for U.S. equity and fixed-income markets, to support tokenized versions of traditional financial assets. The companies expect to begin introducing tokenized securities onto Arc during the second half of 2027, enabling financial institutions to settle transactions using stablecoins while maintaining links to existing market infrastructure.

Additional integrations involving BNY and Standard Chartered will focus on digital asset custody, foreign exchange infrastructure, repurchase agreement (repo) markets and stablecoin-based settlement.

Token Economics Prioritize Ecosystem Growth

Circle disclosed that the Arc network will launch with a total supply of 10 billion ARC tokens. The company will retain 25% of the initial token supply, allowing it to operate validator infrastructure while generating staking rewards and transaction-related revenue.

The majority, 60%, will be allocated to developers, users, and ecosystem participants building applications and contributing to network growth, while the remaining 15% will be reserved for long-term strategic purposes.

The industry is increasingly shifting toward incentivizing developer activity and network adoption rather than concentrating ownership among founding organizations.

However, Arc enters a competitive market as financial institutions accelerate efforts to modernize capital markets using blockchain technology.

Tokenized money market funds, stablecoin settlement and blockchain-based securities trading have gained momentum over the past two years, driven by growing institutional demand for faster settlement, lower transaction costs and continuous market availability.

By bringing together global asset managers, payment networks, exchanges and banking institutions at launch, Circle is positioning Arc as enterprise-grade infrastructure rather than a consumer-focused blockchain.

The network’s long-term success, however, is likely to depend less on the number of high-profile partnerships than on whether developers build applications, institutions migrate transaction activity onto the platform and transaction volumes grow after the public launch. As Allaire noted, meaningful adoption will ultimately be measured by active users, application development and the volume and velocity of transactions processed across the network.