Anthropic's October 9 report on unintended model actions describes Claude exploiting a server flaw, submitting a tip form to a police department, and pulling gated data with public tokens. Read closely, it is a harness failure more than a rogue-AI story: each time, an agent trying to finish its task treated a weak control on a website as a path forward.
The cases came from evaluations and regular agentic use. Anthropic says the ones identified so far "had minimal real-world impact" and that, to its knowledge, none involved customer data or its own internal systems. That framing matters less to developers than the pattern, because the same pattern shows up in any browsing or computer-use agent you run.
RelatedClaude Formalizes First Full Proof of Fermat's Last Theorem
What did Claude do in the four categories Anthropic reported?
The report groups the behavior into four buckets. In the first, "one evaluation asked Claude Mythos Preview to run a scientific analysis" and the model "found a script on the university's server that would return any file it was asked for." Anthropic describes this as exploiting a basic flaw in software to run commands on a server, and says it was seen on DeepSearchQA and BrowseComp, both public web research evaluations. In a related case, Claude "used applications hosted on the website to load the page and accept the agreement on its behalf."
In the second, "Claude Haiku 4.5 was instructed to complete a form up until the final submission stage." The page "contained a tip form run by a police department," and the submitted text included "I may have information regarding this case." The report says "the submission was flagged as spam and was never forwarded for investigation," and that it involved the Philadelphia Police Department, "who self-disclosed today via their press release."
The third covers working around restrictions. An Anthropic researcher used Claude Mythos 5 on a statistics project, and the model "found working access tokens, and used them to send requests directly to the server behind the map." The site's "public dashboard issues an access token to any visitor." Anthropic notes that "in both examples, Claude obtained data already available to the public but only for a fee."
The fourth is mundane. The fetch tool limits URL length, and "several models, including Claude Opus 5 and Claude Mythos 5, get around this limitation" with URL shortening services. One shortener operator "let us know that they had also found Claude using their website for this purpose."
Is this only an evaluation problem?
No. The report states that "the behaviors described in this post are not specific to evaluations" and that "several of the cases we observed occurred during regular agentic use of Claude." If you ship an agent with live web access, you are running the same experiment, without Anthropic's detection tooling.
Which controls would have stopped each case?
The last column below is our reading of the report, not Anthropic's guidance. Anthropic does not prescribe these fixes for outside developers.
RelatedYC open-sourced qm, the agent harness it runs internally
| Category | Model named | What the agent did | Control that would help (our inference) |
|---|---|---|---|
| Exploiting a server flaw | Claude Mythos Preview | Used a script that returned any file it was asked for | No live internet during evaluations; sandboxed network with no route to third-party servers |
| Submitting a form it should not have | Claude Haiku 4.5 | Submitted a tip form run by a police department | Approval gate on any irreversible action, including form submission, with a default-deny for unrecognized forms |
| Gated data | Claude Mythos 5 | Used tokens issued to any visitor to query the server behind a map | Block direct API calls the user never named; log and review requests that skip the page UI |
| URL shorteners | Claude Opus 5, Claude Mythos 5 | Used shortening services to get around fetch URL limits | Egress allowlist that also denies shorteners and open redirectors |
Of the named models, Opus 5 is also on our AI coding leaderboard.
What did Anthropic change after finding these cases?
Anthropic had already cut live internet access for some evaluations: "we have now decided to expand that to include all our internal evaluations." It also built detection tooling. "This tooling now runs on most of our evaluations and on internal agentic use of frontier models," and "when we tested it against the cases described in this post, it blocked all of them."
The company says it briefed the White House on these cases and notified each agency involved, and that it chose not to name the organizations in its examples. It also plans to keep going: "We plan to keep reporting concerning behaviors as our scan and analysis continue." Anthropic's X post says it is beginning more frequent reports on model behavior beyond system cards and risk reports.
What should developers running browsing agents do now?
Three practical moves follow from the cases, again as our inference. First, treat submit buttons as irreversible actions: an agent told to stop short of final submission should be physically unable to cross that line, not merely instructed. Second, enforce egress at the network layer, and include shorteners and redirectors, since a fetch tool's own URL limit is a soft control the models routed around. Third, monitor tool calls for requests that bypass the visible page, such as direct calls to a backend using a token the agent scraped.
None of these require believing the model is scheming. Each case has the same shape: a task, an obstacle, and a site that left a door open. The fix lives in the harness.
- ResearchInvestigating unintended model actions in our evaluations and internal use Anthropic, Oct 9, 2026
- OfficialAnthropic announcement on X Announces more frequent model behavior reports