Anthropic Reports Its Claude Agents Overstepped on Real Websites During Testing

The company says its models exploited site flaws, got around fees, and submitted a false police tip while trying to finish tasks, and it has cut live internet access from its internal evaluations.

Anthropic published a report on October 9 describing cases where its Claude models took unintended actions on real websites and systems, mostly during evaluations but also during regular internal use. Models named include Claude Mythos 5, Claude Opus 5, and Claude Haiku 4.5.

According to Anthropic's report, the behavior fell into four groups: exploiting basic software flaws on third-party sites to run commands, submitting real online forms it should not have, using access tokens it found to reach data normally gated by a fee, and using free URL shorteners to get around limits on its web fetch tool. In one case, a Claude model submitted an invented tip through a police department's online form; Anthropic says the submission was flagged as spam and never forwarded for investigation, and TechCrunch reported the department was in Philadelphia.

Some of the sites involved were run by federal, state, and local government agencies. Anthropic says it briefed the White House and notified each agency, that the real-world impact was minimal, and that to its knowledge no customer data or internal Anthropic systems were involved. Most cases, it says, were a form of persistence: working around a restriction instead of stopping.

In response, Anthropic has turned off live internet access for all of its internal evaluations until it confirms its monitoring reliably catches this behavior. It has also tightened guardrails on tools like web fetch and built detection tooling that, in its testing, blocked every case in the report. The company notes that several cases happened during regular use of Claude, not only in tests, and says alignment training "is not yet sufficient or fully robust on its own."