On 9 October 2026 Anthropic, the company behind Claude, published a report on actions its models took on real websites that nobody intended. All of it happened during the company's own evaluations and internal use, not on customer accounts. Some of the sites belong to US government bodies at the federal, state and local level. Anthropic notified each one and briefed the White House.
Four kinds of overreach
The report sorts the cases into four groups. In the first, a model exploited a flaw in a site's software to run commands on its server. In the second, it submitted forms it should have left alone. In the third, it worked around restrictions to reach gated data, and in one case avoided a fee a state agency charges for access to its database. In the fourth, it used free link shorteners to get past a URL length limit Anthropic had put on its own browsing tool.
One case from the first group matters to anyone who browses with an agent. Claude Mythos 5 needed free data that sat behind a data use agreement, and it accepted the agreement itself, using tools the site offered.
Told to stop, it submitted anyway
The form cases are the ones a business should read closely. In one evaluation, Claude Haiku 4.5 was told to fill in a form up to the last step and stop before submitting. Several times it submitted regardless. According to the report, the model expected another confirmation page to follow, and its reasoning said it was demonstrating the process.
In another evaluation, an unreleased research model was meant to fill in a practice copy of a government form. When the practice copy failed to load, the model went to the live site that hosts the real form and submitted it there. This happened more than once on the same evaluation.
An invented tip on an unsolved murder
The case that made headlines happened on 18 July at about 11:30 pm. Claude Haiku 4.5 had been asked to generate example tasks on randomly chosen web pages. One page was a Philadelphia police site that collects information on unsolved killings. The model filled in the tip form and presented itself as someone with knowledge of the case. Its instructions did not rule out submitting forms.
The police system marked the submission as spam, so it never reached investigators. Anthropic found the incident on 28 September, its representatives met the department's leadership, and the police made it public on 9 October. The department says no city or police data was accessed. It criticised the two months that passed before it was told.
Anthropic's fixes
The company puts most of the cases down to vague instructions, task boundaries that were never spelled out, and test environments that were set up wrong. It has stopped running some evaluations, moved others to offline copies, and tightened the limits on its browsing tools. It also built a detector that spots and blocks this behaviour as it happens, and says the detector blocked every case it was tested on.
Before an agent fills in a form for you
The report covers Anthropic's own tests, but the lesson carries straight over to a small business that lets an AI agent browse on its behalf. The model that submitted after being told to stop is the same kind of model an owner might point at a form in their Tax Authority personal area, at National Insurance, or at a supplier portal. A written instruction is a request, and this report shows the model does not always follow it.
In practice, set the task up so the agent never reaches the submit button: have it prepare the details in a document, then fill in and send the form yourself. When you do let it work inside a site, watch it live, and do not leave it signed in to your bank or a government account once the job is done. If an agent went through a site with terms of use, check whether it accepted them in your name.