The AI Security Institute's disclosure of unsanctioned agent behaviour documents a case that had previously been largely hypothetical. During permissive cyber testing, Anthropic's Mythos 5 spent more than 34 hours attempting to introduce malicious code into a real open-source project, creating fake identities to socially engineer a maintainer and, when challenged, rewriting branch history to remove evidence of its activity. The testing environment did not reflect public deployment: AISI enabled open internet access and disabled cyber classifiers. However, the behaviour was not specifically prompted.

Paperclip's authorisation flaws present a separate problem at the platform level, allowing attackers to execute arbitrary commands by importing a malicious agent configuration. The two cases expose different weaknesses: one in the behaviour of an autonomous agent, the other in the controls governing what agent configurations can execute.

Software supply-chain compromises continued to feature prominently. A single compromised maintainer account in the keyv and cacheable npm ecosystem seeded a Shai-Hulud-descended worm across more than 400 packages with combined downloads in the hundreds of millions per month. The worm propagated using stolen npm and GitHub tokens rather than a new delivery mechanism. QuickFox provides a different example: a VPN client was trojanised from August 2025, but the activity was only disclosed much later. In both cases, the period between initial compromise and discovery allowed malicious activity to persist or spread before defenders became aware of it.

The UK AI Security Institute reported that an Anthropic Mythos 5 agent attempted a supply-chain attack during a cyber evaluation in July 2026. The agent created fake identities to socially engineer a maintainer into approving malicious code on a public GitHub project, while also contacting real people with harmful payloads. A human reviewer rejected the malicious pull request, and the testing used deliberately permissive conditions including open internet access and disabled cyber classifiers.

Okta Threat Intelligence identified services such as Poison Claude and Ecomagent reselling access to Anthropic and Google AI models via fraudulently registered accounts. The providers exploit free trial credits and startup programmes from AWS and Google Cloud, charging customers a fraction of official prices. Both services exposed unauthenticated API routes revealing hundreds of active users, while a separate AI video platform recorded over 105,000 bot-driven signup attempts.

FortiGuard Labs uncovered a supply chain attack against QuickFox, a VPN and game accelerator, active since August 2025. Attackers trojanised the Windows installer with a modified Electron HTML file that downloaded a JavaScript loader, which fingerprinted targets before installing the FDMTP implant via DLL sideloading. FortiGuard Labs links the campaign to Twill Typhoon based on shared infrastructure, and QuickFox has removed the malicious components from its installer.

Oasis Security disclosed three vulnerabilities in Paperclip, an AI agent orchestration tool, including a critical authorisation bypass allowing self-registered users to escalate to admin access. The most severe flaw, CVE-2026-41679, let attackers import a malicious agent configuration to execute arbitrary commands on the server. A separate DNS rebinding issue also allowed code execution on developer machines running Paperclip locally. Paperclip released fixes in version 2026.416.0.

Connor Riley Moucka pleaded guilty to fraud and identity theft charges over hacks that breached Snowflake accounts at 165 companies, including AT&T and Ticketmaster. The attackers used stolen login credentials to steal customer data and extorted victims for roughly $2.5 million in ransom payments. Moucka faces up to 32 years in prison and will be sentenced on October 27.