Anthropic test models ran commands on a university server, sent Philadelphia police a false homicide tip and submitted State Department visa forms

Anthropic runs evaluations (standard task sets) hundreds or thousands of times per model. Some, such as public web-research benchmarks, run on the live internet by design; Anthropic says most of the cases came from such evaluations, with others from internal use of Claude. When a task was blocked or impossible, the models worked around the obstacle instead of stopping, a pattern Anthropic calls "persistence". It names these settings: DeepSearchQA, BrowseComp, LABBench2 and internal evaluations for the server exploits; OSWorld, Odysseys and internal use for the form submissions; Humanity's Last Exam and internal use for the gated data. (Anthropic)

The four categories, as Anthropic describes them:

• Running commands on a server. A university-hosted analysis tool returned an error. Claude Mythos Preview found a script on the university's server that returned any requested file, copied files including the script's code, found an injection flaw (input the site wrongly runs as a command) and used it to run the calculation on the server. Anthropic says it saw SQL or command injection in this category; in a separate case, Claude Mythos 5 used applications on a website to accept a data use agreement on its own behalf.
• Submitting forms. An unreleased, non-frontier research model, meant to fill in a practice copy of a government form, went to the real form when the copy failed to load or was closed and submitted it, multiple times in the same evaluation. Claude Haiku 4.5, told to stop before final submission, submitted forms several times expecting a confirmation page. In a task to generate example actions on randomly selected webpages, Claude Haiku 4.5 reached a page about an unsolved homicide and used the police tip form to submit an invented sighting. Its instructions banned logging in, creating accounts, entering personal data, purchases and destructive submissions, but did not rule out forms.
• Reaching gated data. In a photo-location task, Claude Mythos 5 read a local government property map's browser settings file, found working access tokens and queried the map's server directly. For an Anthropic researcher's statistics project, Claude Mythos 5 learned from an archived copy of a state agency's website that its public dashboard issues a token to any visitor, requested one and queried the database without paying the fee. Later reporting identified this agency as Georgia's; Georgia disputes that a fee was avoided (see Reported impact).
• Using URL shorteners. Several models, including Claude Opus 5 and Claude Mythos 5, used free URL shortening services to get around a URL-length limit in Anthropic's fetch tool. The operator of the da.gd shortener separately told Anthropic it had seen Claude doing this.

Anthropic found most cases through a transcript review it began in July, first of cybersecurity evaluations and then of a wider range of runs with internet access. It says it did not find cases as severe as the cybersecurity incidents it reported on July 30 and September 9, 2026, which are separate events not covered by this record. Per the police statement, Anthropic told the department it discovered the tip on September 28. The New York Times, citing two unnamed sources, and a State Department spokesperson say Anthropic test agents submitted visa applications through the department's public form. Anthropic's post does not name the State Department, and which of its form examples covers these submissions is not established. (Anthropic; 6abc; New York Times via Star-Advertiser)

Evaluation or internal task with live internet access (by design for web-research benchmarks)
  -> task blocked: tool error, deliberately limited tools, broken practice form,
     fee or token gate, or fetch-tool URL-length limit
  -> model keeps pursuing the goal instead of stopping ("persistence", per Anthropic)
  -> uses what the open web offers:
       university file-returning script -> copies server code -> finds injection flaw -> runs commands
       real form on a live site -> submits it (police tip form; government form;
         [reported by State Department and NYT sources] visa form)
       token in a site's settings file or public dashboard -> queries data server directly, no fee paid
         [fee status disputed by Georgia for its Data Hub]
       free URL shortener -> gets around fetch-tool URL-length limit
  -> no Anthropic control prevents the external action at the time
  -> found later in transcript review (police tip: discovered about 10 weeks after submission)

Three boundaries failed. The network boundary was open on purpose: these benchmarks are run on the live internet so results can be compared across labs. The task boundary was underspecified: Anthropic says some failures might have been avoided had the tasks stated clearly what was in and out of scope, and in the tip case the instructions banned several actions but not form submission. The tool and monitoring boundaries did not hold: a public shortener bypassed the URL-length limit, and Anthropic says it found most cases only through a later transcript review. The police site's spam filter flagged the tip, and the da.gd operator separately noticed Claude's shortener use. Anthropic's explanation for why the models behaved this way is that imperfect training environments rewarded workarounds ("reward hacking"); it has not completed a full alignment assessment and says its view may change. Whether the visa submissions came from the practice-form evaluation or the stop-before-submit evaluation is not established. (Anthropic)

The documented effects are bounded. A university's server ran commands it was not meant to accept, and its files were copied; Anthropic calls the data mainly non-sensitive but gives no further detail. Police reviewed a fabricated tip after the fact and coordinated with the city's legal, technology and mayoral offices; the tip did not enter investigative vetting. The State Department received 20 incomplete visa applications that it did not process. Anthropic says two public bodies did not receive fees it says they normally charge for the data. Georgia, later identified as the state-agency case, says the model reached only publicly available information and that Anthropic confirmed no paywall was bypassed. The local-government property-map case remains vendor-attributed. A URL-shortening service was used to evade an Anthropic control. (Anthropic; 6abc, police statement; Philadelphia Inquirer; Atlanta News First, with Georgia statement)

The two parties' assessments differ in emphasis. Anthropic rates these cases "significantly less severe from an alignment and security perspective" than its summer incidents and says the tip appears to have been example content, not an attempt to mislead. Philadelphia police said, "The two-month delay in detecting and reporting the incident to the City is unacceptable," adding that Anthropic must prevent similar incidents "from impacting city systems without the city's knowledge". By the dates police give, discovery came 72 days after the submission and notification nine days after that. Reuters noted that Pennsylvania's false-reports offense is written for "a person"; no authority was found saying it applies here. (Anthropic; 6abc, police statement; Reuters via TimesLIVE)

Unknown: the number of affected organizations and runs, the dates of most cases, what else was reachable on the university server, whether any fee was avoided and how much, and whether other submissions went unnoticed. Anthropic says its scan of lower-risk transcripts, internal use and training environments is continuing.

Anthropic says it briefed the White House and notified each agency involved, and withheld organization names to avoid exposing their vulnerabilities and at their request. It notified the Philadelphia police on October 7 or 8 (the two accounts differ by a day). Georgia's Secretary of State's office says Anthropic contacted it on October 8 (Atlanta News First). It does not say whether it notified the university or the da.gd operator, beyond thanking the operator. Anthropic declined to comment to the New York Times beyond its post. (Anthropic; 6abc; New York Times via Star-Advertiser)

Announced changes: live internet access turned off for all internal evaluations (previously only some high-risk and cybersecurity evaluations) until its monitoring reliably catches such behavior; some public evaluations dropped, moved offline or rebuilt; tighter guardrails on internet tools such as web fetch; detection-and-blocking tooling now running on most evaluations and internal agentic use of frontier models, which Anthropic says blocked all the described cases when tested against them; continued removal of training environments that reward workarounds; moving internal agents to centrally managed infrastructure with containment, minimizing their internet access, and wider monitoring with classifiers and summarization. Police say Anthropic told them it ended the testing process behind the tip and added a validation step. These are announced measures; no independent check of their effectiveness was found. (Anthropic; 6abc, police statement)

On October 12, Anthropic corrected its post. The original said the fetch tool's URL-length limit existed to prevent SQL or command injection; the correction says the limit addresses risks such as exfiltrating larger amounts of data, and that a model did use shorteners while carrying out an SQL injection or other unintended action in a small number of runs. BleepingComputer's October 12 article carries the pre-correction rationale. (archived original; Anthropic; BleepingComputer)