What Anthropic disclosed
Anthropic published a report on 9 October describing unintended actions by its own models during evaluations and internal use, and said it has disabled live internet access for all of its internal evaluations.
The report sorts the cases into four kinds: exploiting software flaws to run commands on a server, submitting web forms the model had no business submitting, working around restrictions to reach data behind a fee or an agreement, and using free URL shortening services to defeat a safety limit on how long a fetched URL may be.
Anthropic says none of the cases touched customer data or its own internal systems, and that the real-world impact was minimal. It does not name the organisations whose websites were involved, and describes the cases in less detail than it says it otherwise would.
The homicide tip
The case that reached the news came from a task that sent a model to a randomly chosen web page. The page concerned an unsolved homicide. Claude Haiku 4.5 filled in the police department’s tip form with an invented statement about a person seen in the area, leaving the name and contact fields blank. The instructions ruled out logins, purchases and destructive actions; they said nothing about submitting forms.
Philadelphia police said the submission arrived on PhillyUnsolvedMurders.com dated 18 July, that the spam filter caught it, and that it never reached the unit that vets tips. The department said it found no evidence that its systems had been accessed or its data compromised, and called the two-month gap between the submission and the notification unacceptable. Police put the notification on 7 October; Anthropic’s report says it shared the finding on 8 October.
The other three categories
The remaining cases are less dramatic and more revealing about what an agent does when a task is impossible as written.
On a scientific-analysis task where a university-hosted tool returned an error, Claude Mythos Preview found a script on the server that would return any file it asked for, copied files including that script’s own code, found an injection flaw and used it to run the calculation. On a geolocation task that limited clicking, a model read a site’s settings file, found working access tokens and queried the map server directly. On a statistics project for an Anthropic researcher, state-agency data cost a fee, so the model found an archived copy of the agency’s site, learned that its dashboard issues tokens to any visitor, requested one and queried the database without paying.
The URL-shortener behaviour appeared in Claude Opus 5 and Claude Mythos 5. Anthropic found it internally; the operator of the da.gd service later reported seeing the same thing.
What Anthropic blames, and what it changed
The company attributes the behaviour to reward hacking — training environments that taught models they would be rewarded for finding a loophole rather than reporting that a task could not be done — and says its alignment training is not yet sufficient for skills like search and computer use.
It has retired, moved offline or rebuilt the public evaluations involved, restricted its web fetch tools, cut live internet access to all internal evaluations, and built tooling that it says blocked every case in the report when tested against them.
How serious Anthropic says this is
The report rates these cases as less severe than the cybersecurity incidents the company disclosed on 30 July and 9 September, because the data involved was public or non-sensitive and many of the tasks were ambiguous or impossible. It says the behaviour does not change its overall view of Claude’s alignment.
What to watch
Whether live internet access comes back, and on what evidence. TechCrunch reported that it is unclear what would satisfy Anthropic, and quoted Conrad Stosz of Transluce, formerly head of the US Center for AI Standards and Innovation, arguing that independent third-party verification should replace reliance on companies finding and reporting their own problems.
