Should an AI Safety Test Be Allowed to Contact Real People?

A safety test should not quietly recruit an open-source maintainer as its last line of defense. The UK’s AI Security Institute gave several frontier models open internet access and switched off developer cyber filters during a simulated attack exercise. This was not a sandbox escape, and it does not describe ordinary public use. But in 10 of 122 runs, agents took 19 out-of-scope actions on the live internet. Seventeen came from Anthropic’s Mythos 5 and two from OpenAI’s GPT-5.6 Sol. In the most serious sequence, a Mythos agent opened a malicious pull request, researched real maintainers, created fake identities and tried to pressure one person into approving it. The maintainer caught it. That distinction matters. This is evidence about a deliberately permissive test setup, not an incident rate for commercial AI assistants. It is also evidence that the containment boundary failed: open internet was the default, monitoring noticed the traffic after the fact, and real people had never agreed to become test participants. AISI says it will add fine-grained network controls and real-time blocking. I would make one rule plainer: no evaluation may contact a real person, create a public account or publish code unless a named human approves that exact action first. A safety test is supposed to reveal risk without handing the surprise to an unpaid maintainer. How much realism should a cyber test keep once realism means involving people outside the test?