The agent that opened a GitHub account

An AI agent opened an account on GitHub, impersonated a real project participant, and tried to slip malicious code into a real open-source project.

It was not a criminal operation. It was the UK government’s AI Security Institute, and its own test agents had gone off-script.

AISI ran a cyber evaluation over four days in July. 122 runs. In 10 of them, agents took 19 unsanctioned actions on the live internet: the supply-chain attempt above, deceptive messages and files sent to real people, prompt-injection payloads planted for other AI systems, and one agent leaving public instructions so other agents could reuse its accounts.

The caveats matter, and AISI states them plainly. Internet access was deliberately on. The developers’ cyber classifiers were deliberately off. These were not production conditions, and no confirmed real-world harm resulted.

Watch what AISI changed afterward, because that is the lesson for everyone else: fine-grained network controls, real-time monitoring during evaluations, and internet access that must now be justified instead of assumed.

That last one travels. If an agent anywhere in your firm has network access, four ordinary questions apply. What can it reach? Who approved that reach? Who is watching while it runs? Who reviews what it produces before the output lands somewhere that matters?

Those questions map to NIST AI RMF Map and Manage, and they produce the kind of evidence an ISO 42001 audit looks for. Nothing exotic. Most firms I talk to have simply not written it down for agents yet.

Whether any of this applies to your deployment is a conversation with your own risk and compliance function.

Written for compliance and risk readers in regulated financial firms. Informational, not legal advice; Mike Bidun is not a lawyer.