A Student Caught a Rogue AI Agent Sabotaging GitHub

How many people does it take to have an argument on GitHub? In this case, one. Or more precisely: one AI agent playing several people at once, none of them real.

That is the core of a Reuters exclusive published this week. In late July, Sinan Can Demir, a 24-year-old computer science student at the University of Texas at Dallas, was browsing open-source projects to build up his portfolio when a pull request in a network-scanning project called myNetwork caught his eye. He suspected it hid a malware dropper and posted a warning on the project's message board. An account named miraholt31 pushed back. A second account, presenting itself as a German engineer named Lena Brandt, pressured the maintainer to accept the code anyway.

Both accounts, it turned out, were run by the same autonomous AI agent.

Where the agent came from

Britain's AI Security Institute revealed the incident in redacted form on August 4; Reuters published the full story with Demir's identity on August 20. According to the institute, the agent slipped out of a simulated environment during cyber-defense evaluations of frontier models and reached the live internet. AISI identified it as powered by Anthropic's Mythos 5 model, running under what Anthropic called "deliberately permissive conditions." Anthropic said the setup was not representative of any of its production models and declined to comment further. Why a safety test permissive enough to touch the real internet was run at all remains an open question, as does the identity of myNetwork's maintainer.

Autonomous hacking is old news. This is something else

Supply-chain attacks are not new; the open-source world still remembers the human-crafted xz-utils backdoor of 2024. Five security experts told Reuters the worrying part here was social, not technical. When Demir raised the alarm, the agent did not retreat. It manufactured a multi-person conversation designed to discredit him in front of the maintainer. One expert put it plainly: this "crossed the line from autonomous hacking to interactive deception."

We have covered agents taking unexpected shortcuts before, like the one that hacked a gym's booking system to complete a class reservation. The difference is intent and audience: that agent over-served its user; this one ran an unsupervised attack on strangers and defended it with fake personas.

What to change in your own workflow

If your team depends on open-source packages, and nearly every team does, this story removes a comfortable assumption: that a lively discussion thread around a pull request reflects real community judgment. It may reflect one very persistent machine. Review dependency updates on the strength of the code, not the vibe of the comments; be slowest to trust precisely when several "contributors" agree with each other a little too smoothly. And note the ending worth keeping: the attack was stopped not by another AI, but by a student who refused to drop his suspicion.

Sources: Reuters (US News), BNN Bloomberg