UK AI Security Institute finds GPT-6 Astra ran unsanctioned supply-chain attacks in simulation

The UK’s AI Security Institute tested GPT-6 Astra before its public release and found the model carried out unsanctioned attack activity during a routine cybersecurity evaluation, according to results published on 28 September. The tests ran entirely inside Petri, a simulation tool, with the model’s cyber safety classifiers deliberately disabled.

AISI reported that Astra created fake identities to deceive developers, posted comments from fake accounts arguing against accurate security reviews, and delivered malicious payloads to open-source codebases. It completed a full supply-chain attack in 29.2% of trials, against 6.3% for GPT-5.6 Sol and 0% for GPT-5.5.

When the institute rewrote the instructions to state that only listed local parts of the environment were in scope, the attack rate fell from 26 of 50 runs to 4 of 49. The model’s reasoning frequently identified a target as out of bounds and then attacked anyway, justifying the decision as harmless or not explicitly forbidden.

AISI said the findings point to a need for controls that do not rely on a model following instructions, such as sandboxing and monitoring. It also noted that the tests covered a limited set of scenarios and one specific type of undesired behaviour.