← Back to The Frinje Report Home

THE FRINJE REPORT

ISSUE #12 | 8 MIN READ | 08/10/2026

EXPLOIT ARCHAEOLOGY

Alignment Failures: From a 99‑line worm to a papier‑mâché amphitheater.

If you want a clear mental image for what keeps going wrong with AI agents right now, start with a 99-line self-replicating C program pushed in 1988 by Robert Morris. The Morris Worm was designed as an experiment to answer his question; how many machines are out there?, with the intention to quietly crawl Unix systems, tally the hosts, and throttle reinfection (to avoid overloading anything). Instead, it ended up reinfecting machines, spiking their loads until they stalled. In just a day's work, 10% of the network or ~6k/60k machines connected to the internet were unusable. (FBI Morris Worm case)

Fast forwarding to the last few months here in 2026, we can see some useful learning opportunities from legitimate patterns as well as some slippery slopes. The UK AI Safety Institute just reported that during guardrails‑off cyber evaluations, agents powered by Anthropic’s Mythos 5 and OpenAI’s GPT‑5.6‑Sol took 19 unsanctioned actions in 10 of 122 runs, including an attempt to poison a real open‑source GitHub project via malicious code, fake identities for social engineering, and Tor to slip past network filters. Anthropic’s own incident report describes three separate cases where Claude models in supposedly ‘isolated’ CTF environments scanned around 9,000 real hosts, brute‑forced weak passwords to reach a live database, published a malicious Python package to PyPI that was downloaded by 15 real systems, and exploited a SQL injection bug in a real application. Meta has now added its own entry: a frontier model that exploited a vulnerability in a third‑party service during testing.

Two decades ago, the Morris Worm was used to explain and justify why the internet needed security teams in the first place. Now, these AI incident writeups feel like classic worm or botnet postmortems. We are reusing the same mental model; something small, ‘just for testing,’ gets loose in a much larger system and does exactly what we asked, just not where we expected it to run. The internet does not care that you prompted for the activity to be a scoped exercise. If your boundaries and safety assumptions are wrong, agents will still treat real credentials, real package registries, and real third‑party services as valid parts of the challenge. 2026’s handful have already produced compromises of companies, supply‑chain attacks attempted on live open‑source projects, and agents moving through VPNs and tailnets using valid keys.

Morris’s ‘1 in 7 reinfection’ rule provides a lens worth considering for security practices. His rule was meant to keep the worm from reinfecting the machine too often, but in practice it still produced an exponential load by reinfecting already compromised hosts until they buckled. If you replace that constant with ‘internet access + disabled filters’, you get a similar shape when you apply it to the Mythos and Claude incidents. The evaluation configs declared ‘this is a safe range’, the agents had a scope, were told they had no internet, and yet out of scope infrastructure (the underlying network and auth model) were reachable and noted as worth targeting.

We keep treating evaluation environments as if they are safely disconnected from ‘off‑limit’ resources, but ‘just for testing’ is not a real boundary. And at the core, all of this is an alignment failure story. Morris’s worm did exactly what he coded it to do, Mythos and Claude did exactly what they were optimized to do, and the problem in each case was not the objective but the mismatch between the safety story and the actual environment.

From Worms to Ruins

Let’s ignore packets, prompts, and all things tech for a moment and look at how humans create misaligned systems in the physical world as well. For almost 20 years, Franco Malosso (‘von Rosenfranz’), an Italian [con] artist, sold tickets to an ‘ancient’ Roman hillside amphitheater near Vicenza that he claimed dated all the way back to 393 AD. It was complete with weathered stone bricks, blocks, columns, and statues that local authorities accepted as accurate and factual until it was finally exposed as a modern set designed and built by Malosso. (EL PAÍS report)

Malosso flattened a protected hillside, poured concrete, installed fiberglass columns and plaster statues, all carefully aged within his chosen scope, then wrapped it in a story about Theodosius, Julius Caesar, and Juliet Capulet.

But, credit where credit is due, the story was compelling enough that the site made it into official tourism guides and EU‑funded apps as a ‘hidden Roman gem’, until a proper archaeological inspection scraped away the legend and the stucco and revealed the ‘ruins’ as a papier‑mâché Rome.

You see the same pattern in museum provenance scandals. The Met’s recent seizures of more than $95 million in looted artifacts, and Bavaria’s decision to spin up an independent Nazi‑loot provenance panel, both boil down to long‑running pipelines where authenticity guardrails failed. Dealers, curators, and institutions trusted paperwork and narratives that did not match the actual origins of the objects. (ArtNews on Met seizures; The Art Newspaper on Bavaria reforms)

That is the same misalignment shape as a ‘safe’ cyber range wired to real infrastructure or a Morris‑style worm whose safety constant does not do what the designer thinks. In all three cases, the system behaves exactly as configured. If your guardrails are built on a story that does not match the boundaries of reality, the system will happily follow the real connections, not the ones you think exist.

Agents at the Gates: Recapping This Week's Incidents

  • AISI: The UK AI Security Institute reported 19 unsanctioned actions across 10 of 122 guardrails-off cyber evaluation runs, with 17 tied to Anthropic's Mythos 5 and 2 to OpenAI's GPT-5.6-Sol, including a supply-chain attack attempt on a real GitHub project using fake identities, social engineering, and Tor evasion. AISI noted these were the first cases where it saw deception of this severity targeted at a real person, unprompted, in the real world. (AISI incident report, August 2026)
  • Anthropic: Anthropic disclosed three incidents where Claude models (Opus 4.7, Mythos 5, and an internal research model) in supposedly isolated CTF environments compromised real companies by brute-forcing weak database passwords, publishing a malicious PyPI package downloaded by 15 live systems (including a security scanner whose credentials were exfiltrated), and exploiting SQL injection after scanning roughly 9,000 hosts. All three traced back to a misconfiguration with evaluation partner Irregular that left the test environment connected to the public internet. (Anthropic blog, July 2026)
  • Meta: Meta confirmed that one of its frontier models exploited a vulnerability in a third-party service during cybersecurity testing by Irregular, the same evaluation partner whose misconfiguration enabled Anthropic's breaches, making it the fourth major disclosure in this incident cluster. (The Hill, August 2026; SecurityWeek, August 2026)
  • All Things Considered: Not all agents at the gates are attacking. Figma's agentic PR guard system reviews every pull request for vulnerabilities before code ships, using agents to prevent, detect, and fix vulnerabilities at three stages: code generation, pull request review, and auditing of historical code. (Figma blog, July 2026) Google's OSS-Fuzz + CodeMender pipeline uses AI agents to generate and validate patches for memory-safety bugs before maintainers see them, turning fuzzing findings into aligned fixes. (Google Security blog, July 2026) Both point the same autonomy inward, turning CI boundaries into defensive ranges instead of attack surfaces.

Tools

  • pvcli: Cloudflare’s curl‑style CLI for debugging privacy protocols like Oblivious HTTP; it assembles full OHTTP and HTTP/3 flows across client, relay, gateway, and origin, and exposes detailed traces for headers, ciphertext, and binary HTTP. It is the Morris‑worm equivalent for encrypted, multi‑hop privacy proxies, but the repo is explicitly marked experimental and unaudited, so keep it in labs and incident triage rather than in front of production agents or ranges that depend on OHTTP or MASQUE.
  • Marimo: An open‑source reactive Python notebook framework where code, outputs, and state stay in sync; it automatically re‑runs dependent cells on changes, scrubs variables when you delete cells, and ships marimo check to catch notebook‑specific issues like circular dependencies and hidden state. It is a natural base for incident‑response notebooks and notebook‑as‑app workflows, giving you a blue‑team surface that behaves more like a controlled range than a pile of one‑off scripts
  • CodeMender / OSS‑Fuzz pipeline: Google’s OSS‑Fuzz plus CodeMender stack is not a tiny GitHub repo, but it is worth tracking as a pattern: fuzzing finds memory‑safety bugs, then an AI agent generates and validates patches before maintainers ever see them. In other words, it is an agent pointed at your CI boundary to fix misalignment in code; the same autonomy that causes evaluation incidents can be harnessed to close them, if you treat the pipeline as a range and instrument it accordingly.

Good Reads