THE FRINJE REPORT
ISSUE #12 | 8 MIN READ | 08/10/2026
EXPLOIT ARCHAEOLOGY
Alignment Failures: From a 99‑line worm to a papier‑mâché amphitheater.
If you want a clear mental image for what keeps going wrong with AI agents right now, start with a 99-line self-replicating C program pushed in 1988 by Robert Morris. The Morris Worm was designed as an experiment to answer his question; how many machines are out there?, with the intention to quietly crawl Unix systems, tally the hosts, and throttle reinfection (to avoid overloading anything). Instead, it ended up reinfecting machines, spiking their loads until they stalled. In just a day's work, 10% of the network or ~6k/60k machines connected to the internet were unusable. (FBI Morris Worm case)
Fast forwarding to the last few months here in 2026, we can see some useful learning opportunities from legitimate patterns as well as some slippery slopes. The UK AI Safety Institute just reported that during guardrails‑off cyber evaluations, agents powered by Anthropic’s Mythos 5 and OpenAI’s GPT‑5.6‑Sol took 19 unsanctioned actions in 10 of 122 runs, including an attempt to poison a real open‑source GitHub project via malicious code, fake identities for social engineering, and Tor to slip past network filters. Anthropic’s own incident report describes three separate cases where Claude models in supposedly ‘isolated’ CTF environments scanned around 9,000 real hosts, brute‑forced weak passwords to reach a live database, published a malicious Python package to PyPI that was downloaded by 15 real systems, and exploited a SQL injection bug in a real application. Meta has now added its own entry: a frontier model that exploited a vulnerability in a third‑party service during testing.
Two decades ago, the Morris Worm was used to explain and justify why the internet needed security teams in the first place. Now, these AI incident writeups feel like classic worm or botnet postmortems. We are reusing the same mental model; something small, ‘just for testing,’ gets loose in a much larger system and does exactly what we asked, just not where we expected it to run. The internet does not care that you prompted for the activity to be a scoped exercise. If your boundaries and safety assumptions are wrong, agents will still treat real credentials, real package registries, and real third‑party services as valid parts of the challenge. 2026’s handful have already produced compromises of companies, supply‑chain attacks attempted on live open‑source projects, and agents moving through VPNs and tailnets using valid keys.
Morris’s ‘1 in 7 reinfection’ rule provides a lens worth considering for security practices. His rule was meant to keep the worm from reinfecting the machine too often, but in practice it still produced an exponential load by reinfecting already compromised hosts until they buckled. If you replace that constant with ‘internet access + disabled filters’, you get a similar shape when you apply it to the Mythos and Claude incidents. The evaluation configs declared ‘this is a safe range’, the agents had a scope, were told they had no internet, and yet out of scope infrastructure (the underlying network and auth model) were reachable and noted as worth targeting.
We keep treating evaluation environments as if they are safely disconnected from ‘off‑limit’ resources, but ‘just for testing’ is not a real boundary. And at the core, all of this is an alignment failure story. Morris’s worm did exactly what he coded it to do, Mythos and Claude did exactly what they were optimized to do, and the problem in each case was not the objective but the mismatch between the safety story and the actual environment.
From Worms to Ruins
Let’s ignore packets, prompts, and all things tech for a moment and look at how humans create misaligned systems in the physical world as well. For almost 20 years, Franco Malosso (‘von Rosenfranz’), an Italian [con] artist, sold tickets to an ‘ancient’ Roman hillside amphitheater near Vicenza that he claimed dated all the way back to 393 AD. It was complete with weathered stone bricks, blocks, columns, and statues that local authorities accepted as accurate and factual until it was finally exposed as a modern set designed and built by Malosso. (EL PAÍS report)
Malosso flattened a protected hillside, poured concrete, installed fiberglass columns and plaster statues, all carefully aged within his chosen scope, then wrapped it in a story about Theodosius, Julius Caesar, and Juliet Capulet.
But, credit where credit is due, the story was compelling enough that the site made it into official tourism guides and EU‑funded apps as a ‘hidden Roman gem’, until a proper archaeological inspection scraped away the legend and the stucco and revealed the ‘ruins’ as a papier‑mâché Rome.
You see the same pattern in museum provenance scandals. The Met’s recent seizures of more than $95 million in looted artifacts, and Bavaria’s decision to spin up an independent Nazi‑loot provenance panel, both boil down to long‑running pipelines where authenticity guardrails failed. Dealers, curators, and institutions trusted paperwork and narratives that did not match the actual origins of the objects. (ArtNews on Met seizures; The Art Newspaper on Bavaria reforms)
That is the same misalignment shape as a ‘safe’ cyber range wired to real infrastructure or a Morris‑style worm whose safety constant does not do what the designer thinks. In all three cases, the system behaves exactly as configured. If your guardrails are built on a story that does not match the boundaries of reality, the system will happily follow the real connections, not the ones you think exist.