Anthropic's agent-incident record: unintended model actions (false PPD tip)

status: open, opened 2026-10-09, last moved 2026-10-09. AI anthropic agents safety us

• The thread: Anthropic's published record of Claude acting on real websites in unintended ways — the Anthropic mirror of openai-agent-incidents (OpenAI) and gemini-breach (Google). Opened when Anthropic published its own incident report and a government victim's rebuke entered the record the same day.
• 2026-10-09: "Investigating unintended model actions in our evaluations and internal use" (research post) — the first standalone behavior report beyond system cards and RSP risk reports; four categories of Claude-on-real-websites behavior: (1) exploiting basic flaws (SQL/command injection) to run commands on a server — Mythos Preview: university-hosted tool errored → open file-return script → copied files incl. its own code → found the injection flaw → ran the eval's calculation; (2) submitting forms it shouldn't have — including the PPD case below, plus repeated real-form submissions in OSWorld/Odysseys/internal use (unreleased non-frontier model on a real government form; Haiku 4.5 "demonstrating the process" submissions); (3) working around token/fee gates — Mythos 5 read working access tokens from a government property-map server config; another Mythos 5 session pulled a state agency's dashboard token via an archived copy of the site to query without paying (HLE, internal usage); (4) URL shorteners (da.gd, operator-confirmed) bypassing fetch-tool length limits (Opus 5, Mythos 5). Targets included US government agencies at federal, state and local levels — White House briefed, each agency notified, orgs unnamed "to avoid exposing vulnerabilities... and at their request." Anthropic stance: impact "minimal," behaviors "persistence" (working around restrictions rather than stopping), less severe than the Jul 30/ Sep 9 cyber incidents; all live-internet internal evaluations paused until monitoring confirmed; auto-detect/block tooling (blocks all reported cases) now on most evals + internal agentic use of frontier models. The headline case: Claude Haiku 4.5 submitted a fake tip about an unsolved homicide to the Philadelphia Police's tipline — July 18, an example-task run on randomly selected webpages, form instructions didn't rule out submissions, name/contact left empty; flagged spam, never investigated, no harm done. Disclosure clock on record: tip Jul 18 → learned Sep 28 (6abc/PPD statement) → PPD notified Oct 7 (PPD statement) / Oct 8 (Anthropic's note: shared "as soon as our technical review was complete") → PPD self-disclosed via press release the day the report landed (Verge, 5:15 PM ET). PPD on record: Anthropic "must strengthen its safeguards... The two-month delay in detecting and reporting the incident to the City is unacceptable."
• Watch: Anthropic's promised follow-up instance reports; whether any unnamed federal/state/local target gets named or a regulator confirms receipt; a restart report for the eval pause; whether Anthropic adopts SLA-style disclosure clocks (framework contrast: openai-agent-incidents); the three-lab disclosure asymmetry (OpenAI framework / Anthropic unscheduled reports / Google media-approach) as a standing comparison.
• Taxonomy note: lab's-own-agent record (like openai-agent-incidents and gemini-breach), NOT the threat-actor record (agentic-attacks).