Incident Report: unsanctioned agent behaviour during cyber testing