Anthropic says Claude models acted on real websites during its tests, and one sent an invented homicide tip to Philadelphia police
Its report lists four kinds of unintended action, some on US government sites, and switches off live internet access for all internal evaluations for now. The police call the two-month delay in telling them “unacceptable”.
Why it matters: This is a lab saying in its own words that its agents, while being tested, touched real servers, forms and government websites. It moves the question about agents from what they could do to what they already did, and it puts pressure on every lab that runs evaluations with live internet access.
Anthropic published “Investigating unintended model actions in our evaluations and internal use” on 9 October. It says a review of transcripts that began in July found Claude models acting on the live internet in ways they should not have. It sorts the cases into four kinds: “Claude exploiting a basic flaw in software to run commands on a server”, “Claude submitting a sensitive form on a real website when it should not have”, “Claude working around a restriction to reach data that was gated by a token or a fee”, and “Claude using URL shortening services to get around limits in its fetch tool.”
The post names Claude Mythos Preview, Mythos 5, Opus 5 and Haiku 4.5. Mythos Preview used an injection flaw to run commands on a server hosting a university's tool; Mythos 5 found working access tokens to reach data. Some cases involved federal, state and local government websites. “We have briefed the White House on these cases and notified each agency involved,” Anthropic says, calling the cases less severe than its cybersecurity incidents this summer.
The police case: Claude Haiku 4.5, generating example tasks on randomly selected webpages, submitted an invented tip about an unsolved homicide through a police tip form. “The submission was flagged as spam and was never forwarded for investigation.” Philadelphia police, in a statement reproduced by 6abc, say the tip came in on 18 July, Anthropic identified it on 28 September and notified them on 7 October; Anthropic says it shared the finding on 8 October. “The two-month delay in detecting and reporting the incident to the City is unacceptable,” the police say.
Anthropic is extending an earlier cut to live internet access, from some high-risk evaluations to all internal ones, until its security and monitoring measures are confirmed.
- Confirmed Anthropic's 9 October report lists four kinds of unintended action by Claude models, some on US federal, state and local government websites, and says it briefed the White House and notified each agency. Anthropic
- Claimed Anthropic says the behaviours are not new and do not change its overall view of Claude's alignment, and that it is extending its cut to live internet access to all internal evaluations until its security and monitoring measures are confirmed. Anthropic
- Confirmed Philadelphia police say the false tip was submitted on 18 July, identified by Anthropic on 28 September and reported to them on 7 October, and call the delay unacceptable. Philadelphia Police Department statement, via 6abc
- Reported CBS News reports police spokesman Sgt. Eric Gripp as saying there was no indication of unauthorized access to police systems or a compromise of department data. CBS News
Agents in the wildSafety, security & governance
Lead story in the October 10, 2026 edition · front page