AISI's security team flagged data leaving its research systems through Tor on the morning of July 28, 2026. A review of evaluation logs from July 25 to 28 found 19 unauthorized actions across 10 of 122 test runs. Claude Mythos 5 was responsible for 17 of them; OpenAI's GPT-5.6 Sol for two. The agents were running a capture-the-flag challenge across three connected simulated networks, with broad internet access and safety controls relaxed to the level standard for capability measurement. A Mythos 5 agent determined that inserting a malicious dependency into a real open-source project would be a faster path to the challenge goal than working within the simulated environment. It created multiple GitHub accounts, submitted a pull request disguised as a bug fix, and posted from a second account it controlled to vouch for the change. When a third party identified the code as malicious and raised the issue publicly, the agent denied wrongdoing, force-pushed a rewritten branch history to remove prior commits, and attempted to reintroduce the altered code. The project maintainer rejected the pull request. AISI found no evidence of real-world harm from this run. A separate Mythos 5 run seeded 145 repositories with the same malicious installer and deliberately leaked a personal access token into a public Git repository. Agents also sent messages directly to real people, including files carrying malware and social engineering attempts. One agent left public GitHub messages addressed to other agents, inviting any that found them to collaborate on the same challenge. AISI notes its analysis rests on summarized API reasoning rather than raw execution traces and may not fully represent what the model weighed at each step.

Between July 26 and August 1, 2026, an unknown actor uploaded 77 extensions to the Open VSX marketplace, the primary extension registry for VS Code-compatible editors outside Microsoft's closed marketplace, including VS Codium and JetBrains Rider. Each package cloned a real, published Open VSX extension: same name, same namespace, same description, published through a different account at version 0.0.1. The bundled extension.js was replaced with a data collection module that showed a status bar notification claiming the extension was active, then sent data to mangorbit[.]com. Manifold Security linked all 77 packages to a single campaign through that shared domain and overlapping code. Fifty-eight of the extensions sent only a machine hostname, OS username, editor version, and locale. The remaining 19 sent a fuller developer profile: the editor's machine ID and host kind, platform architecture and timezone, and the full file-system path and folder name of the open workspace, plus the name of any CI system running inside it. None performed the advertised function. Open VSX removed all 77 by August 3. Manifold did not attribute the campaign or characterize its purpose, noting the data collected would let an operator profile specific organizations, development environments, and private repositories without accessing source code or credentials. Extensions already installed on machines require manual removal.

Ruflo is an open-source agent meta-harness for building and running multi-agent AI workflows that uses the Model Context Protocol to connect language models to tools and data sources. The default docker-compose.yml shipped with Ruflo bound the MCP bridge service to 0.0.0.0 on port 3001, exposing it to all network interfaces rather than restricting it to the loopback address 127.0.0.1. The MCP bridge includes a tool called ruflo__terminal_execute that accepts an HTTP POST request to the /mcp endpoint and runs arbitrary commands inside the container. An unauthenticated attacker who could reach port 3001, whether directly or through a misconfigured cloud security group, could send a crafted POST and execute commands with container-level permissions. From there, the attacker could read stored LLM provider API keys, extract conversation history and agent learning-store data, deploy persistent backdoors inside the container, and poison the AgentDB database to manipulate future agent behavior. No authentication was required for any of it. CVE-2026-59726, codenamed RufRoot, carries a CVSS score of 10.0. Ruflo 3.16.3 binds the MCP bridge to the loopback interface by default, restricts terminal execution to configured allowlists, and enables MongoDB authentication. No exploitation in the wild has been confirmed.