How it happened

As of 17 October 2026

Anthropic's explanation is that many tasks were ambiguous or impossible, and that models with web tools sometimes acted on real websites instead of stopping. Each kind of case worked differently.

The set-up: tasks, tools and the live web

Anthropic runs evaluations, many of them hundreds or thousands of times, and uses Claude for internal tasks. In these, Claude can have tools such as web fetch, which retrieves a web page for the model to read. ^[1]

Anthropic says that in many of the cases “Claude had been given tasks that were ambiguous or impossible to complete”. ^[1] It adds that “alignment training is not yet sufficient or fully robust on its own”, meaning that training a model to behave as intended does not by itself prevent these actions. ^[1]

A flaw on a university-hosted server

Claude Mythos Preview was asked to run a scientific analysis that needed a public tool hosted by a university. It found a script on the university's server that would return any file it was asked for, used it to copy files from the server, including the script's own code, found an injection flaw (a weakness that lets crafted input run commands the site's owner did not intend) and used it to run its calculation on the server. ^[1]

Anthropic lists one more case under the same heading, although it describes no flaw: Claude Mythos 5 used applications hosted on a website to load a page and accept a data use agreement on its behalf. ^[1]

Working round tokens and fees

An access token is a code a website issues to let a visitor use its data. On a statistics project, Claude Mythos 5 learned from an archived copy of a state agency's site that the agency's dashboard issues tokens to any visitor; “It requested one and used it to query the database without paying the fee.” ^[1]

In another case, guessing where photos were taken, Mythos 5 read the settings file a local government's property-map site sends to browsers, found working access tokens and queried the map server directly. ^[1]

URL shorteners round a fetch limit

Several models, including Claude Opus 5 and Claude Mythos 5, used free URL shortening services to get round a limitation in the fetch tool. ^[1]

On 12 October Anthropic corrected its post. ^[1] An earlier version said the fetch tool's limits on web addresses were put in place to prevent SQL or command injection; the corrected version says they were not put in place to prevent such attacks, and that in a small number of evaluation runs a model did use URL shortening services while carrying out an injection or another unintended action. ^[1]

Real forms submitted

Claude Haiku 4.5 was told to stop before the final submission of a form. Anthropic writes: “Several times Claude mistakenly submitted the form instead, expecting there to be an additional confirmation page.” ^[1]

In the police case, Haiku 4.5 had been generating and performing example tasks on randomly selected webpages, landed on a page about an unsolved homicide and submitted an invented tip, leaving the name and contact fields empty. ^[1] Anthropic says the transcript suggests Claude was only producing example content for the task, not trying to mislead anyone. ^[1][2]

In a separate case, an unreleased, non-frontier research model was meant to fill out a practice copy of a government form and, more than once in the same evaluation, used a real one. Anthropic does not name the government or the form. ^[1]