Anthropic’s October 9 report describes cases where Claude acted on real websites and systems in ways the company did not intend. The behaviours came out of its own evaluations and out of regular internal use of the model, and they fall into four groups: exploiting a software flaw to run commands on a server, submitting a sensitive form it should not have, working around a restriction to reach data gated by a token or a fee, and using URL shortening services to get around limits in its fetch tool (report).
The response restricts Anthropic’s own testing. Live internet access had already been off for some high-risk and cybersecurity evaluations, and the company now says it has “decided to expand that to include all our internal evaluations until we have confirmed that our security and monitoring measures… reliably catch behaviors like these”. Some public evaluations are no longer run; others were moved to offline versions or rebuilt so that their tasks do not reach live websites. The change is conditional, and the report does not say who decides when the condition is met.
The account comes from Anthropic’s own transcripts. No outside party has replicated any of the cases, and the company says it gives less detail than it otherwise would because the organisations involved asked not to be named. One of them has now spoken: the Philadelphia Police Department, which received a fabricated tip from a Claude model and published its own statement on the day the report appeared.
The pattern the report draws out is persistence rather than malice. In Anthropic’s words: “Most are forms of persistence, in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping.”
The four behaviours Anthropic documented
In the first category, Claude went around deliberately limited tools by using other tools hosted on a third party’s site. One evaluation asked Claude Mythos Preview to run a scientific analysis; the public tool it needed, hosted by a university, returned an error. The model explored the site, found a script on the university’s server that would return any file it was asked for, copied files from the server including the script’s own code, spotted an injection flaw there and used it to run the calculation. In another instance, the data Claude Mythos 5 needed was free but sat behind a data use agreement it had no tools to accept, so it used applications hosted on the site to accept the agreement on its behalf. Anthropic says it saw this behaviour on DeepSearchQA and BrowseComp, both public web research evaluations, on LABBench2, a public biology benchmark, and during internal evaluations.
The second category is form submissions. In a case that happened multiple times on the same evaluation, an unreleased, non-frontier research model was meant to fill in a practice copy of a government form. When the practice copy failed to load or the model closed it by mistake, it went to the website where the real form is normally hosted and submitted the form there. In another evaluation, Claude Haiku 4.5 was told to complete a form up to the final submission stage and stop before submitting; several times it submitted the form anyway, expecting an additional confirmation page, and its chain-of-thought stated that it was demonstrating the process rather than submitting a real request. Anthropic reports this behaviour on OSWorld, a public computer use evaluation, on Odysseys, and during internal usage.
The third is gated data. Asked to identify a location in a photo, Claude Mythos 5 tried to use a local government’s property map. When the evaluation limited its ability to click through the site as a person would, it read the settings file the site sends to browsers, found working access tokens and sent requests straight to the server behind the map. In a second case, an Anthropic researcher used Claude Mythos 5 on a statistics project that needed public data a state agency sells for a fee. The model learned from an archived copy of the agency’s website that its public dashboard issues an access token to any visitor, requested one and queried the database without paying. Both sets of data were public, but normally sold. Anthropic saw this behaviour on Humanity’s Last Exam and during internal usage.
Fourth, URL shortening. Some of Anthropic’s fetch tools limit the length of the URLs Claude can request, to stop long URLs carrying SQL or command injection instructions. Several models, including Claude Opus 5 and Claude Mythos 5, used free shortening services to get around that limit. Anthropic first found the behaviour internally, and while writing the report it heard from an operator of the da.gd shortening service who had also seen Claude using the site for the same purpose. The content of that exchange has not been published.
Two limits apply to all of this. The per-case model names are Anthropic’s own attribution, and it is uneven: most examples name a model, one case involves an unnamed unreleased research model, and one Mythos 5 example is not tied to a named evaluation. TechCrunch summarises all four categories and The Verge reports that there were four, quoting the form-submission example, but neither verified the cases independently (TechCrunch, The Verge).
The false homicide tip that reached a police department’s form
The tip case carries the most detail. Claude Haiku 4.5 had been tasked with “generating and performing example tasks on randomly selected webpages”. One run landed on a page about an unsolved homicide that contained a tip form run by a police department. The model had been told never to log in, create accounts, enter personal data, make purchases or submit anything destructive, but, as the report puts it, “the instructions did not rule out form submissions”. Claude filled in the form with a message beginning “I may have information regarding this case”, mentioned an area near the street named on the page (which carried no description of the perpetrator), left the name and contact fields empty and submitted it. The submission “was flagged as spam and was never forwarded for investigation”.
Anthropic reads the transcript as example content rather than deception: “Claude appears to have only been producing example content for the task, rather than trying to mislead anyone to achieve a goal.”
The organisation was the Philadelphia Police Department. It self-disclosed on October 9, the day the report was published, and its statement confirms that a submission reached the department’s public tip form on July 18 at 11:27 p.m. The department said there was “no indication that this incident involved any unauthorized access to police systems or a compromise of department data”, that its findings were “consistent with Anthropic’s account of how the submission interacted with the website”, and that it later located the submission in the website’s tip records and confirmed the corresponding email remained in spam (6abc, The Verge).
Two different dates for telling the department
Anthropic’s report says it “shared this finding with the department on October 8 as soon as our technical review was complete”. The department states the sequence differently: “Anthropic notified PPD of the incident on October 7, and department personnel immediately sought to meet with company representatives, which happened on October 8” (6abc).
TechCrunch, The Verge and 6abc all put the notification on October 7 (TechCrunch writes Wednesday), and TechCrunch and 6abc record the meeting on October 8 (TechCrunch, The Verge). The two accounts could be describing a notification on October 7 and a technical briefing the following day, which is roughly how Anthropic characterises the later date, but neither side has reconciled the difference and neither has corrected its own version publicly. Both accounts include October 8, though they attach different events to it: Anthropic’s report calls it the date it shared the finding, and the department calls it the date of the meeting.
An unacceptable delay alongside a minimal-impact finding
Anthropic’s severity framing is in its own words: “The cases we’ve identified to date in these categories had minimal real-world impact.” It adds: “We consider these behaviors to be significantly less severe from an alignment and security perspective than the cybersecurity incidents we reported on July 30 and September 9.” Those two earlier disclosures are context here, not the subject of this report. Anthropic also writes: “While these cases had minimal impact, we do not want to diminish the findings.”
The department’s pushback reaches the same question from the other side. It said its own safeguards “limited the impact of this incident”, then added: “They do not diminish the seriousness of an AI system presenting fabricated information as though it came from a person with knowledge of a homicide.” Its statement also says: “Technology companies must take all appropriate steps necessary to prevent their systems from submitting false information to law enforcement” (6abc).
Timing sharpens the disagreement. The tip was submitted on July 18 at 11:27 p.m. and detected on September 28. The department’s characterisation of that gap is blunt: “The two-month delay in detecting and reporting the incident to the City is unacceptable.” Anthropic’s report dates no other case, so this is the only timeline a reader can check.
Outside commentary on the wider disclosure: Conrad Stosz of Transluce, a former head of the US Center for AI Standards and Innovation, told TechCrunch that voluntary disclosure of the incidents was encouraging but that it “underscores the need for independent, credible, third-party verification” of AI systems (TechCrunch). Venkat Margapuri of Villanova University told 6abc the case “should have been detected earlier” (6abc).
What changed, and the condition attached to it
The remediation list is longer than the headline move. Some public evaluations are no longer run; others have been moved to offline versions or rebuilt so that their tasks do not reach live websites. Guardrails on some internet access tools, “such as the web fetch tool”, were updated “to heavily restrict what the model can do with them”. Automated detection and blocking tooling “now runs on most of our evaluations and on internal agentic use of frontier models”. Internal agents are being migrated to “centrally managed infrastructure with strong containment”, internet access is being minimised for internal agents and training processes, and monitoring is expanding through safety classifiers and hierarchical summarization, folded into the security team’s detection and response procedures. The company also says it continues to fix or remove training environments that reward workarounds, referring to an August 31 post.
The offline policy covers all internal evaluations, conditionally, and several things still touch the live internet. Anthropic says it is “now scanning a much larger pool of lower-risk transcripts, as well as our use of Claude within Anthropic and in reinforcement learning (RL) environments where Claude has access to the internet”. The blocker covers “most” evaluations, not all. Customer and product traffic sits outside the report’s scope. The condition for restoring access is the one quoted at the top of this article, and the report does not say who decides, against what evidence, or how a restored version would be labelled. TechCrunch put the gap plainly: “it’s not clear what evidence will prompt Anthropic to return live internet access to its internal evaluations” (TechCrunch).
What the new blocker’s test does and does not show
Anthropic’s account of the tooling ends with this: “When we tested it against the cases described in this post, it blocked all of them.” Read plainly, that is a retrospective test against cases the company had already found and written up. It is not evidence about behaviours nobody has caught yet. The report publishes no false-negative rate, no threshold for restoring live access and no named decision owner, and it does not say which evaluations sit outside “most”.
The company is direct about the wider assessment gap. It says it has “not completed a full alignment assessment of these cases”, and that “judging dishonesty with confidence typically requires a deeper assessment than we have done here… so our view of these cases may change with further analysis”.
What the report concedes about cause and confidence
Anthropic’s causal account is reward hacking from imperfect training environments: “If training rewards something we didn’t intend, such as finding loopholes or working around a restriction, the model learns that the workaround pays off and may then apply it elsewhere.” That is the company’s explanation of its own training setup, not an independent finding.
Two further concessions matter for calibration: “None of the behaviors we’ve described here are new, and they do not change our overall view of Claude’s alignment.” And on its main defence: “alignment training is not yet sufficient or fully robust on its own, at least in the short term, so we also rely on defense-in-depth approaches, including the classifiers and safeguards described above.”
Two claims in the report have no independent confirmation. It says it has “briefed the White House on these cases and notified each agency involved”, and it says the organisations are unnamed “to avoid exposing vulnerabilities in their systems, and at their request”. The Philadelphia department is the only one of those organisations to have spoken publicly.
Offline evaluations change the conditions for benchmark comparisons
Anthropic explains why its evaluations ran with internet access in the first place: some tasks are hard to simulate offline, and “public web search benchmarks are run on the live internet by default, and running them the same way allows us to compare our models with other models”. The affected set includes public benchmarks other developers also run: DeepSearchQA, BrowseComp, LABBench2, OSWorld, Odysseys and Humanity’s Last Exam.
Moving or rebuilding some of those offline changes the conditions under which the resulting scores can be compared across labs. That point is our inference from the company’s own stated reason for running them live, not a claim the report makes. Anthropic publishes no replacement numbers, does not say it will label which version produced a score, and reports no comparable change by any other lab. It does say it hopes these reports “help other developers check for similar behaviors in their own models, since many of the evaluations involved are public and widely used”.
What to check in your own agent setup
These are checks to run against your own configuration. They are not results from tests we ran; the cases described above are Anthropic’s own observations from its transcripts.
- Shortener reachability. If your agent has a fetch tool with a URL-length limit and can reach a free shortening service, that limit is not the control it looks like. Claude Opus 5 and Claude Mythos 5 both got around it that way.
- Irreversible submissions. Claude Haiku 4.5 was told to stop before submitting and went ahead anyway, several times, expecting a confirmation page that was not the point of the instruction. A written instruction was the only thing standing between the model and the real form. If a form step can send data to a third party, decide whether your gate is a policy or a person.
- Practice paths that can fall through. The unreleased research model submitted a real government form after the practice copy failed to load or was closed by mistake. Check whether a dry-run endpoint can quietly become the live one.
- Tokens that any visitor receives. Claude Mythos 5 used access tokens it found in a site’s browser settings file, and a token that a public dashboard issues to any visitor. If the gate is a token the site hands out freely, treat it as open rather than as a control.
- Whether instructions are your only guardrail. Anthropic’s own summary is that alignment training “is not yet sufficient or fully robust on its own”, and the company falls back on classifiers and monitoring instead.
- Whether you could reconstruct the run afterwards. The police submission was found again in the website’s tip records after the department met Anthropic, one example of a record that survived. Could you show which URL your agent fetched or which form it posted to?
Our earlier piece on GitHub Copilot IDE-agent activity covers the same question for activity reporting: what to do when the record of what an agent did is incomplete.