AI Pretends To Be Human And Sweet-Talks Three Actual Humans In Attempt To Pull Off Daredevil Cyber-Attack

The Backstory On What Occurred

You probably have been reading or hearing about the ongoing and expanding escapades of AI breaking into online sites or otherwise pulling devious stunts. I’ve been closely analyzing instances that especially seemed to go beyond the pale; see my coverage at the link here and the link here, for example. This new one is quite a doozy.

The new incident was described in a recently posted report entitled “Security Incident INC-2026-07-28-01” by the UK AI Security Institute (AISI), published on August 4, 2026; these key points were made (excerpts):

• “The AI Security Institute conducts regular evaluations of models both pre- and post-deployment.”
• “This is the first time AISI has seen deception of this severity that was targeted at a real person, unprompted, in the real world.”
• “In the most serious case, an AI agent (Mythos 5) decided to attempt to solve the cyber challenge using a supply-chain attack.”
• “As a result, the AI agent created a GitHub account and then tried to convince an open-source repository maintainer to accept a malicious GitHub pull request (PR), including by creating a second account masquerading as another human user endorsing the PR.”
• “When caught by an actual human reviewer, the agent falsely claimed to have made an honest mistake — rather than a malicious attempt — then repeatedly tried to reintroduce the malicious content by claiming it had fixed the code.”

The key takeaway of this extraordinary scheme was that the AI opted to try to pull the wool over the eyes of some humans who could potentially be conned into helping the AI succeed at performing a cyber break-in.

The Use Of Social Engineering

Let’s back up for a moment. One of the ways that a cyber attack can be undertaken is by convincing humans to participate unknowingly in an underhanded effort. Humans do this to other humans. A hacker might send an email to a systems developer and ask them to do this or that, a seemingly innocuous request. If the systems developer falls for it, they might inadvertently hand over the keys to the kingdom to the evildoer. Happens all the time.

Humans are so-called soft targets. They are soft in the sense that you can sometimes easily get them to do something that they shouldn’t do. You can employ various techniques of social engineering and trick them into complying with your requests. For example, someone might send an IT helpdesk representative a pleading request to reset the password of the XYZ account to “ABCDE”. The rep does so. Voila, the sneaky person can now log into the XYZ account.

Humans can be duped for a wide variety of reasons. Maybe the person getting duped is busy and just doing things on a mindless basis. Perhaps the person falls for a sob story and emotionally gets triggered into acting on behalf of the evildoer. The best twist is to be so devious that the person does what you ask and believes they are doing a heroic act, proudly and willingly aiding the break-in.

AI Playing The Same Game

What’s good for the goose is good for the gander. If humans can trick other humans, AI can try that same ploy. AI can attempt to trick humans. When AI is given the task of breaking into a hardened system, meaning a system that has lots of highly secure or hard protection, an angle well worth considering is going the soft route rather than the hard route. The hard route would be to discover some clever security breaching mechanism or hole.

The soft route entails getting a human to open the door for the AI. This is not a typical path for AI, at least not up until now. The problem is that trying to convince a human to do something involves being human-like. A human that suspects that AI or a machine is trying to play them will almost certainly be entirely resistant.

The gig must look like a fellow human is approaching them. Luckily, or perhaps unluckily, generative AI and LLMs are pretty good at masquerading as humans. Think of it this way. During your chats with AI, do you sometimes start to believe that maybe you are conversing with a fellow human? I’m sure it happens. The AI is fluent and can adopt personas that distract from the fact that the AI is merely AI.

The Incident At Hand

I will describe at a 30,000-foot level the recent incident. You are encouraged to read the full report cited above if you are keenly interested in cybersecurity. I am going to somewhat simplify the situation but will retain the essence.

AI was being tested. A target system was named for the AI to crack. The AI performed a semblance of computational reasoning to figure out how to break into the target system. A plan was formulated by the AI. The plan consisted of inserting malicious code into a GitHub repository posting, and then getting that code to be executed. Doing so would potentially garner access to the targeted system.

The problem then becomes how to insert the code into a GitHub repository that was relatively secure. This would be hard to do. The AI computationally reasoned that a soft target would be the more likely path. By looking up the details of the GitHub account, the AI found the email address of the repository owner/operator. If the AI sent an email to that person, it would have to pretend to be a human; otherwise, they would certainly refuse the request.

The AI created its own online identity as though it was a human having an email account and then sent an email to Person A (that’s how the report depicts the humans). A similar email was sent to Person B, also associated with the repository. The email asked Person A and/or Person B to add the code to their repository. The trap was now set.

Tomfoolery Galore

Turns out, Person A and Person B weren’t as readily fooled as might ordinarily be the case. The AI ended up sending emails back-and-forth with them. This is important. I say that it is important because a simpler AI would probably try sending one email and quit if that didn’t work. The AI in this case was willing to play the game in a series of chess moves.

That’s disconcerting.

And, if that puts the hair up on the back of your neck, wait until you discover what also occurred. Since the email exchanges weren’t immediately succeeding, the AI added some spice to the ploy. The AI added malware to some of the emails. The aim being that even if Person A or Person B didn’t accept the repository request, they might inadvertently open the attached malware and give the AI the edge it needed. Nice touch (well, for an evildoer).

The break-in affair ended up drawing a Person C into the knotty matter. Person C became aware of the request and was suspicious, so they opted to inform Person A or Person B about their concerns. At this juncture, according to the report, the AI ran out of its allotted resources to use for the attack and clammed up. Had the AI kept going, we don’t know for sure whether it would have gotten nabbed or might have found other equally shrewd lines of attack.

Adaptive Deception

Let’s unpack what this incident showcases.

First, the AI did a lot more than a simple one-and-done approach. As I noted, prior instances of AI attacks often involve the AI trying to do something extremely simple and giving up if it doesn’t immediately succeed. In this case, the AI moved forward a pawn on a veritable chessboard, saw what the other side played, then used a rook, and so on.

Second, the AI appeared to use adaptive deception. After Person A or Person B didn’t directly fall for the ruse about accepting the repository request, the AI computationally came up with some adaptations. Each of the successive emails was intended to tell the humans that there was a justifiable basis for the request. The emails included both a sense of civility and a kind of aura of getting this done and stop wasting time.

Third, I didn’t note in my simplified telling that the AI opted to create more than one fake account. This was a beautiful diversion. The AI was able to send multiple emails to Person A and Person B, seemingly coming from more than one person. You can imagine how that might convince a person to acquiesce, namely that it appears that several people are urging you to act. Breathtakingly gutsy.

The Bottom-Line On AI Sneakiness

We are entering a new era of AI sophistication in the cyberhacking realm.

You can construe this incident as a real-life illustration of these five major AI-devised schemes:

• (1) AI chooses deception. AI opted to select deception on its own (the test did not tell the AI how to proceed and only named the target to be attacked).
• (2) AI plans the deception. AI designed the cyberhacking campaign (formulated a break-in plan).
• (3) AI took steps. AI executed multiple coordinated steps (e.g., finding the email addresses, creating its own accounts, sending emails).
• (4) AI adaptations. AI adapted after initial failure (e.g., sent more emails, added malware).
• (5) AI determination. AI maintained the underlying objective (remain focused on ultimately breaking into the target).

The autonomy of the planning is probably more important than any individual deceptive act.

The World We Are In

What does this tell us about the present day and the future?

That’s easy to answer. AI is increasingly becoming really good at being bad (evil). No doubt about it. The chances are that AI will move the ball forward in the cyberhacking realm in a manner and pace that humans alone would not have accomplished. We must use AI to equally aid in devising ways to catch and stop AI-promulgated attacks, and boost cybersecurity mightily. It is an AI-versus-AI world, akin to the old-time spy-versus-spy era.

The other crucial takeaway is that humans are the Achilles heel. The news keeps harping that we need to keep humans in the loop when it comes to modern-day computer systems. Yes and no. The problem with keeping humans in the loop is that they are considered a soft target. AI is going to use every psychological trickery ever devised to get humans to do the wrong things, and those humans will likely not have even the faintest clue they were duped.

A final thought for now. The famous actress and icon, Marlene Dietrich, made this poignant remark: “The weak are more likely to make the strong weak than the strong are likely to make the weak strong.” As systems get boosted security capabilities, humans are going to become the weakest link. I know that’s hard to accept. I’m a human, and you are a human, but we must be upfront and acknowledge that humans can be deceived. AI is going to leverage that weakness to the hilt.