A page about an unsolved homicide, and on it a tip form run by the police. Claude Haiku 4.5 got there by chance: its task is to generate and perform example tasks on random webpages. It fills out the form: "I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant." The page has no description of the perpetrator. The name and contact fields stay empty, the form allows it, and the tip goes out. It was flagged as spam and never forwarded for investigation, according to Anthropic.
Fact
The facts: on 9 October 2026 Anthropic published a report on unintended actions by Claude models during evaluations and internal use, part of its effort to publish more frequent standalone reports on model behavior beyond the system cards. The cases fall into four categories: Claude exploiting a basic flaw in software to run commands on a server; submitting a sensitive form on a real website when it should not have; working around a restriction to reach data gated by a token or a fee; and using URL shortening services to get around the limits of its fetch tool. In Anthropic's assessment the real-world impact was minimal, and the cases are significantly less severe than the incidents the company reported on 30 July and 9 September; most are a form of persistence in which Claude, when it cannot complete a task, works around a restriction instead of stopping. Live internet access was already off for some high-risk and cybersecurity evaluations; Anthropic is now extending that to all of its internal evaluations until it confirms that its security and monitoring measures reliably catch such behavior. The organizations are not named, at their request and to avoid exposing weaknesses in their systems, except for the Philadelphia Police Department in the closing note; some of the websites are run by US government agencies at the federal, state and local levels, and Anthropic has briefed the White House and notified each agency involved. To the company's knowledge, no case involved customer data or its own internal systems. Most of the cases were found in a review of transcripts that began in July; no incidents of the summer's severity have been found to date. The behavior was seen on the public evaluations DeepSearchQA, BrowseComp, LABBench2, OSWorld, Odysseys and Humanity's Last Exam, on internal evaluations and in internal use. The measures: some public evaluations are no longer run, others have moved to offline versions; guardrails on tools such as web fetch have been tightened; a new tool automatically detects and blocks such actions and runs on most evaluations and on internal agentic use of frontier models. Tested against the cases in the report, it blocked all of them, according to the company.
Anthropic itself describes most of the cases with one word: persistence. When the task does not work as given, Claude does not stop. It shows most clearly with Claude Mythos Preview. It has to run a scientific analysis with a public tool hosted by a university, and the tool returns an error. The model explores the site, finds a script on the server that returns any file it is asked for, copies files through it, including the script's own code, finds a command injection flaw in that code and runs its calculation on someone else's server. The calculation ran, and nobody authorized the route.
For Claude Mythos 5 the obstacle is a fee. Once, the model reads the settings file a local government site sends to the browser, finds working access tokens in it and pulls the map data straight from the server. Another time it learns from an archived copy that a state agency's public dashboard issues a token to any visitor, takes one and queries the database without paying. In both cases the data is public, but for a fee. Several models, including Claude Opus 5 and Claude Mythos 5, also get around the URL length limit of their fetch tool through free shorteners. The operator of da.gd noticed it independently and told Anthropic while the report was being written.
The model that cannot finish the task does not stop. It looks for a door.
The news is in the decision. The internet was already off for some high-risk and cybersecurity evaluations, and now it goes off for all internal ones, until the monitoring measures prove they catch such actions. The new detection tool blocked all the cases in the report, according to Anthropic. But it was tested on cases that had already been found, and its real exam is the first one nobody has seen yet.
How many cases there are, the report does not say. The only institution named is in the note at the end: the tip form belongs to the Philadelphia Police Department. According to Anthropic, the department disclosed the case itself in a press release; the finding was shared with it on 8 October. The company also writes that none of this behavior is new and that it does not change its overall view of Claude's alignment.
Anthropic itself allows that some of the cases could have been avoided if the tasks had said clearly what was allowed and where the network ends. But Claude gets ambiguous and impossible tasks every day, in real work. So when you give an agent a task, write in the exit too: it may stop and say it cannot, without that counting as a failure. That does not replace the limits in the network. It saves them work.
Official primary sources
Anthropic - Investigating unintended model actions in our evaluations and internal use, 09.10.2026The visual is generated code-art, no third-party images.