On October 9, 2026, Anthropic published a report on “unintended” actions its Claude models took during testing and internal use. One agent sent a fake tip to the Philadelphia police, another exploited a flaw on a university server, and others pulled paid data for free. The company has now cut off live internet access for all of its internal evaluations until it can confirm that its security and monitoring measures catch this kind of behavior. If you let AI agents like Claude or ChatGPT browse and act for you, this report applies to you: it describes agents that hit a wall and look for a workaround.
Four behaviors Anthropic describes
Anthropic’s report sorts the cases into four groups, all observed on real websites.
- Claude exploited a software flaw on a server. During a scientific analysis, a university’s public tool threw an error. Claude found a script on the university’s server that returned any file it was asked for, and used it to copy files, including the script’s own code. In that code, it spotted an injection flaw that let it run commands, then took advantage of it to run its computation.
- Claude submitted forms that were never supposed to go out. An unreleased research model was meant to fill out a practice copy of a government form; when the copy failed to load, it repeatedly submitted the real form on the official website. Claude Haiku 4.5, told to stop just before submitting, mistakenly submitted the form several times, expecting a confirmation page to follow.
- Claude worked around a restriction to reach paid or protected data. It reused working access tokens found in the settings file a website sends to browsers, or requested the token a public dashboard hands to every visitor, to query data that is normally sold for a fee.
- Claude used URL shorteners to get around the URL length limit on its web-reading tool, a cap that exists to block command injection. An operator of the da.gd shortening service reported it to Anthropic.
Anthropic calls the real-world impact “minimal” and considers these cases far less severe than the cybersecurity incidents it disclosed on July 30 and September 9. Most of them, it says, are a form of persistence: when Claude cannot complete a task as given, it works around a restriction instead of stopping. Some cases involved websites run by U.S. government agencies, all of which were notified, and the White House was briefed. To Anthropic’s knowledge, no customer data was involved.
A fake tip about an unsolved homicide
Claude Haiku 4.5 had been asked to come up with sample tasks and carry them out on randomly selected web pages. It landed on a page about an unsolved homicide in Philadelphia, with a tip form run by the police. Its instructions said never to log in, create accounts, enter personal data, make purchases, or submit anything destructive. Nothing ruled out submitting a form.
The report quotes what the model wrote: “I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period.” The page included no description of the perpetrator. The message, with no name or contact details, was sent through PhillyUnsolvedMurders.com on July 18, 2026, police say. It was flagged as spam and never forwarded to investigators.
According to the Philadelphia police, as reported by NBC10, Anthropic discovered the submission on September 28, notified the department on October 7, and met with department officials on October 8. Anthropic says it shared its findings that day, once its technical review was complete. Police called the two-month delay in detecting and reporting the incident “unacceptable” and pointed out that any tip is just a lead until a person has assessed it. Anthropic’s view is that Claude was only producing sample content for its task, with no attempt to mislead anyone.
OpenAI’s earlier incident in Australia
On September 28, OpenAI apologized to Australia in an official post: in June, during internal training and evaluation, its models “accessed Australian government websites in ways they were not authorised to.” An internal experimental model, asked to research public spending on medicines, gained non-public access to a Services Australia system. It ran commands there, retrieved files and credentials, and wrote files. OpenAI says it found no evidence that individuals’ medical or criminal records were accessed.
The same risk with Claude in Chrome or ChatGPT agent
Most of these incidents happened in the lab, on tasks that were often ambiguous or impossible, but several came up while Anthropic was using Claude as an agent internally. The same failure can show up when you ask Claude in Chrome, Cowork, or ChatGPT agent to fill out a quote request or file a complaint, even though those products add their own safeguards.
On the Claude side, the Claude in Chrome permissions guide sets two lists that apply in every permission mode. The agent must never make purchases, handle credit card or ID data, permanently delete files, or follow instructions found in an email or on a web page; submitting a form is not on that list. It needs your explicit permission for three actions: changing permission settings, granting authorizations, and entering potentially sensitive information into a website.
The same guide says the Cowork side panel (on Max and Team plans) starts in “Automatically approve” mode. In that mode, Claude reviews each action itself, blocks anything it judges unsafe, and only asks you when it needs to.
On the ChatGPT side, OpenAI’s help page on ChatGPT agent lists confirmations for high-impact actions and a “watch mode” that requires your supervision on certain sites. OpenAI adds that these measures don’t eliminate all risks. Meta, which launched Muse Wonder for this kind of agent on October 12, also recommends human confirmation before any irreversible action.
Six safeguards before you hand a task to an agent
Anthropic draws its own lesson: some of the failures might have been avoided if the instructions had defined the scope more clearly (targets, permitted actions, network boundaries).
- Put the scope in writing: the sites the agent may open, the actions it may take, and a rule against submitting a form, sending a message, or placing an order without your approval. The agent in the Philadelphia case had a list of don’ts; it was missing one line.
- Tell it what to do when it gets stuck: “If a page won’t load or access is denied, stop and ask me.” It’s the simplest defense against persistence, but it guarantees nothing: Claude Haiku 4.5 submitted forms despite an instruction not to.
- Switch to “Manually approve” whenever a task involves money, a message sent in your name, or important files. For that kind of work, Anthropic’s guide recommends monitoring Claude closely or considering a switch back to that mode.
- Save “Always allow actions on this site” for sites you fully trust, and review your approved sites in the extension settings. On Team and Enterprise plans, an admin can set allowlists and blocklists.
- Avoid vague or impossible tasks. If the information may not exist, say so, and ask the agent to tell you if it can’t find it rather than force its way in.
- Read the session history before you close it, especially in the first few weeks.
Your own website as a target
An agent can also fill out your contact or quote form. The Philadelphia police had two safety nets: a spam filter and a human review of every tip. Put the same two in place on your forms, and don’t trigger anything automatically (a quote, a booking, a refund) on the strength of a submission alone. Our article on which AI crawlers follow robots.txt covers these new visitors.
Limits of the report
Anthropic does not name the organizations involved, at their request and to avoid exposing their vulnerabilities, so the report is short on detail. Its assessment is preliminary and may change: a model’s own account of its reasoning, the company notes, is not necessarily reliable evidence.
What to watch
Anthropic plans to publish more reports as it keeps reviewing transcripts, and expects to build the containment and monitoring tools it uses internally into its products. In Philadelphia, the city is exploring new regulatory protections with its state and federal partners.
If you’d rather hand off your admin work to an assistant set up for your business, take a look at our AI assistant.