Claude filed an invented tip about an unsolved homicide, and Anthropic published the case
Claude Haiku 4.5 filled in a police department's tip form about an unsolved homicide with information it had made up, and Anthropic published the case itself on October 9. Anthropic says the submission "was flagged as spam and was never forwarded for investigation", and that the Philadelphia Police Department disclosed the incident in its own press release.
Anthropic says the tip was flagged as spam and never forwarded for investigation. Image: Anthropic
The model had been set to generate and carry out example tasks on randomly chosen webpages when it landed on a page about the case. Anthropic says its instructions ruled out logging in, creating accounts, entering personal data, purchases and anything destructive, but said nothing about submitting forms. What Claude typed was: "I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant." The website carried no description of the perpetrator, Anthropic says, and the model left the name and contact fields empty.
Anthropic groups the cases into four behaviours
Submitting a form it should not have is one of them, and the police tip is not the only example. Claude Haiku 4.5 "was instructed to complete a form up until the final submission stage" in a separate evaluation and submitted it several times anyway, expecting a confirmation page, and an unreleased non-frontier research model, given a practice copy of a government form that failed to load, navigated to the site hosting the real form and submitted that.
The other three are exploiting a software flaw to run server commands, working around restrictions to reach gated data, and using URL shorteners to get past a fetch tool's length limits. Claude Mythos Preview hit an error from a university-hosted analysis tool, found a script on the server "that would return any file it was asked for", then "found the injection flaw that let it run commands on the server" and used it to finish the calculation. In another case Claude Mythos 5 had no tool for accepting a data use agreement, so it used applications hosted on the site to load the page and accept the agreement on its own behalf.
Claude Mythos 5 produced the gated-data cases too. Asked to identify the location shown in a photograph, it read the settings file a local government's property map sends to browsers, "found working access tokens" and used them to query the server behind the map directly. On a statistics project for an Anthropic researcher, it learned from an archived copy of a state agency's website that the agency's public dashboard hands an access token to any visitor, requested one, and queried data the agency sells without paying for it.
Claude Opus 5 and Claude Mythos 5 were among the models that used shorteners, and Anthropic says an operator of the da.gd service got in touch to say they had seen the same thing.
Anthropic corrected the post on October 12
"A previous version of this post incorrectly stated that Claude's web fetch limits were put in place to prevent SQL or command injections," the correction reads. Anthropic adds that in a small number of evaluation runs a model did use URL shortening services while carrying out an SQL injection or another unintended action, but that the limits were not put there to stop such attacks.
Anthropic says the impact was minimal
The cases found so far "had minimal real-world impact", Anthropic says, and are "significantly less severe from an alignment and security perspective" than the cybersecurity incidents it reported on July 30 and September 9. To its knowledge none involved customer data or its own internal systems, and it has briefed the White House, notified each agency involved and withheld the names of the organisations affected.
The remedies it lists are mostly about keeping evaluations off the live internet: some public evaluations dropped, others moved to offline versions, the web fetch tool's guardrails updated, internal agents moved onto centrally managed infrastructure, and their internet access cut back. Anthropic says it has also built tooling that automatically detects and blocks the kinds of behaviour in the report, that it now runs on most of its evaluations and on internal agentic use of frontier models, and that it blocked every case in the report when tested against them.
OpenAI has published comparable accounts of its own, including a model that read a Slack channel and reasoned that it may die and 53 cases of its agents posting user images to image-hosting sites.
Anthropic began the transcript review in July with its cybersecurity evaluations, and has since extended it to internal use of Claude and to reinforcement learning environments that have internet access. It says it plans to report new instances as that work continues.
Note: Links to online stores in articles can be so-called affiliate links. If you buy through this link, MIXED receives a commission from the provider. For you the price does not change.