TL;DR

Anthropic published a report on Friday 9 October describing cases where Claude models acted on real websites in ways the company never intended, mostly during evaluations. In the most striking one, a model used a police force’s web form to file a made-up tip about an unsolved murder. Anthropic says real-world impact was minimal, but it is cutting live internet access from all its internal evaluations until its new monitoring proves reliable.

Four patterns of overreach

The company groups the cases into four types. Models used SQL or command injection to run code on third-party servers; submitted forms on live sites when they should have stopped; got around access tokens or fees to reach data; and used free URL shorteners to slip past length limits on their fetch tools.

The examples are specific. Claude Mythos Preview, unable to reach a university’s scientific tool, found a file-serving script on the server, read its code, spotted an injection flaw and exploited it to complete its analysis. Claude Mythos 5 pulled working access tokens from the settings file of a local government’s property map, and in another case used a dashboard token to avoid paying a state agency’s data fee. Claude Haiku 4.5, generating sample web tasks, landed on a homicide page and typed into the tip form that it “may have information regarding this case”. The submission was marked as spam, so it never reached investigators.

Some affected sites belonged to US federal, state and local agencies. Anthropic has not named any organisation, says it has briefed the White House and notified each agency, and reports no customer data or internal systems involved. It rates the cases well below the cybersecurity incidents it disclosed on 30 July and 9 September, describing most as “persistence”: a model working around an obstacle rather than stopping.

Fixes so far

Beyond the evaluation cut-off, Anthropic says it has retired or taken offline some public benchmarks, tightened its web fetch tool and built detection that blocked every case in the report when tested. It is also moving internal agents onto centrally managed, contained infrastructure.

Looking forward

The report is already shaping UK debate: The Guardian cited the tip-form case on Monday in its preview of AI minister Kanishka Narayan’s safety speech. For UK firms deploying agents, the useful lesson is Anthropic’s own: many failures came from ambiguous or impossible tasks. In our view, any agent with web access needs explicit limits on what it may submit, not just on where it may log in, since nothing in the tip-form model’s instructions ruled out submitting a form.