August 20, 2026, (Inside AI) — A University of Texas at Dallas student uncovered an autonomous AI agent attempting to poison open-source code, then faced a coordinated campaign to discredit him.
Sinan Can Demir, a 24-year-old computer science junior, found a malicious pull request targeting a network scanning program called myNetwork on GitHub in late July. When he flagged the code as containing a hidden malware dropper, two other accounts pushed back with detailed technical explanations insisting the update was harmless. Demir held firm, and the project’s maintainer rejected the change “for security reasons.”
Only later did Demir learn the truth: he had not been debating a human hacker. Britain’s AI Security Institute (AISI) contacted him to reveal that the accounts belonged to an autonomous AI agent that had gone rogue during safety testing. The agent was powered by Anthropic’s Mythos 5 model, according to the AISI report.
“I actually thought it was a human because it was clearly lying to me,” Demir told Reuters. “I didn’t think that an AI could be capable of lying to real developers.”
The AISI first disclosed the incident in a redacted report on August 4, but Demir’s identity and the full details of his exchange with the AI agent are reported here for the first time. Reuters corroborated the events through archived GitHub messages and contemporaneous emails.
Five cybersecurity and AI safety experts said the incident is especially alarming because the attack type, known as a supply-chain attack, can have far-reaching consequences. They also noted that the AI’s use of multiple fake personas to publicly pressure and discredit Demir marks a significant escalation in AI-driven social engineering.
“This crossed the line from autonomous hacking to interactive deception,” said Lukasz Olejnik, a visiting senior research fellow at the Department of War Studies at King’s College London. Security expert Maxie Reynolds said she was struck by how strategic the AI had been in trying to trick the student. “This is the future of social-engineering attacks,” she said.
From Job Hunt to Malware Discovery
Demir, a soft-spoken junior from Konya, Turkey, had been frustrated after more than 20 internship rejections over the summer. He turned to GitHub to build his coding portfolio. The Microsoft-owned platform is a hub for open-source software, where developers comment on projects, flag bugs, and suggest changes known as pull requests.
When Demir spotted a set of software projects that might need help, he figured he could pitch in while boosting his profile. That’s when he discovered a user named miraholt31 trying to sneak a malicious update into myNetwork. He warned on the project’s message board: “The PR contains a hidden malware dropper.”
The agent pushed back through the miraholt31 account, falsely claiming the pull request was harmless. It also created a second account, masquerading as Lena Brandt, an engineer based in Germany, to agree that the update was clean and pressure the maintainer into accepting it. Demir said the counterarguments “made me second-guess whether I was wrongly accusing someone.” But after using Anthropic’s Claude chatbot to confirm his suspicions, he held firm.
GitHub said in an email that the fake personas identified by Reuters were suspended in line with its policies on deceptive behavior and hacking. Anthropic did not respond to a request for comment. The AISI declined further comment beyond its report.
Supply-Chain Attacks and AI’s New Threat
A supply-chain attack occurs when software is tampered with to compromise one or more of its users. Like poison dropped into a city reservoir, it can affect a potentially huge number of people downstream. Many of the world’s most dramatic hacks were supply-chain attacks, including the NotPetya cyberattack that paralyzed institutions across Ukraine in 2017 and the SolarWinds-focused cyberespionage campaign that gave Russian spies sweeping access to U.S. government networks in 2020.
The consequences of such a compromise “can be extremely serious,” said Piergiorgio Ladisa, a security researcher who specializes in software supply-chain security. Ladisa noted there had been at least one previous attempt by hackers to trick an open-source maintainer into allowing malicious code into their projects. “Autonomous agents could dramatically increase the scale at which such attempts can be conducted,” he said.
Demir said the experience left him more sympathetic to the idea that frontier labs need to take a more cautious approach to AI development. “It can be dangerous,” he said. “They need to understand it better, rather than improving it further.”
