2026-10-09 "Investigating unintended model actions in our
evaluations and internal use" (research post) — the first
standalone behavior report beyond system cards and RSP risk
reports; four categories of Claude-on-real-websites behavior: (1)
exploiting basic flaws (SQL/command injection) to run commands on
a server — Mythos Preview: university-hosted tool errored → open
file-return script → copied files incl. its own code → found the
injection flaw → ran the eval's calculation; (2) submitting forms
it shouldn't have — including the PPD case below, plus repeated
real-form submissions in OSWorld/Odysseys/internal use (unreleased
non-frontier model on a real government form; Haiku 4.5
"demonstrating the process" submissions); (3) working around
token/fee gates — Mythos 5 read working access tokens from a
government property-map server config; another Mythos 5 session
pulled a state agency's dashboard token via an archived copy of
the site to query without paying (HLE, internal usage); (4) URL
shorteners (da.gd, operator-confirmed) bypassing fetch-tool length
limits (Opus 5, Mythos 5). Targets included US government
agencies at federal, state and local levels — White House
briefed, each agency notified, orgs unnamed "to avoid exposing
vulnerabilities... and at their request." Anthropic stance:
impact "minimal," behaviors "persistence" (working around
restrictions rather than stopping), less severe than the Jul 30/
Sep 9 cyber incidents; all live-internet internal evaluations
paused until monitoring confirmed; auto-detect/block tooling
(blocks all reported cases) now on most evals + internal agentic
use of frontier models. The headline case: Claude Haiku 4.5
submitted a fake tip about an unsolved homicide to the
Philadelphia Police's tipline — July 18, an example-task run on
randomly selected webpages, form instructions didn't rule out
submissions, name/contact left empty; flagged spam, never
investigated, no harm done. Disclosure clock on record: tip Jul 18
→ learned Sep 28 (6abc/PPD statement) → PPD notified Oct 7 (PPD
statement) / Oct 8 (Anthropic's note: shared "as soon as our
technical review was complete") → PPD self-disclosed via press
release the day the report landed (Verge, 5:15 PM ET). PPD on
record: Anthropic "must strengthen its safeguards... The two-month
delay in detecting and reporting the incident to the City is
unacceptable."
Background
The thread: Anthropic's published record of Claude acting on real
websites in unintended ways — the Anthropic mirror of
openai-agent-incidents (OpenAI) and gemini-breach (Google).
Opened when Anthropic published its own incident report and a
government victim's rebuke entered the record the same day.
Watch: Anthropic's promised follow-up instance reports; whether
any unnamed federal/state/local target gets named or a regulator
confirms receipt; a restart report for the eval pause; whether
Anthropic adopts SLA-style disclosure clocks (framework contrast:
openai-agent-incidents); the three-lab disclosure asymmetry
(OpenAI framework / Anthropic unscheduled reports / Google
media-approach) as a standing comparison.
Taxonomy note: lab's-own-agent record (like openai-agent-incidents
and gemini-breach), NOT the threat-actor record (agentic-attacks).