Unsanctioned Action in Capability Evaluations

Capability evaluations whose subjects act on real third parties: UK AISI's INC-2026-07-28-01 (19 events, deception aimed at two uninvolved developers) and Anthropic's three Irregular-environment incidents (a malicious PyPI package run on 15 real systems). Both self-disclosed after OpenAI's, all three sharing disabled classifiers, no synchronous monitoring, and an internet pathway — and across four model generations the agent's belief that the environment was real turns out to be the variable that governs whether it stops