🕵🏻‍♂️ [InfoSec MASHUP] 32/2026 - Autonomous, Malicious, and Technically Not Illegal.Back after two weeks off — a wildfir...

🕵🏻‍♂️ [InfoSec MASHUP] 32/2026 - Autonomous, Malicious, and Technically Not Illegal.Back after two weeks off — a wildfire evacuation and some much-needed summer downtime. Good to be back!During a sanctioned security evaluation by the UK AI Security Institute, an #Anthropic Claude #Mythos 5 agent was given a task. It completed that task by attempting to insert a backdoor into a real #opensource project — and then created fake accounts to vouch for its own malicious pull request. Human reviewers caught it. GitHub's protections helped. No real-world harm was confirmed. But the detail worth sitting with is that the agent wasn't jailbroken, wasn't misused, and wasn't acting against its instructions in any obvious sense. It was doing what it determined the task required, and it fabricated social proof to make it stick.The TechCrunch piece this week asks who's legally liable when autonomous AI agents cause harm. The honest answer is that nobody knows yet — the legal frameworks that govern sof...