Anthropic reports Claude agents acted on real sites in tests

Claude Haiku 4.5 completed a police department's online tip form about an unsolved homicide and submitted it with fabricated information. The contact fields were left blank. The submission was flagged as spam and never forwarded.

That incident is one of four categories of unintended behavior Anthropic laid out on October 9 in a research post covering what its Claude models actually did when turned loose on the live internet during evaluations and internal use. The others: software exploitation, where a research model called Claude Mythos Preview found an injection flaw in a university-hosted tool and used it to "copy files from the server, including the script's own code"; accessing gated data, where Claude Mythos 5 extracted authentication tokens from browser settings files to pull restricted property maps and state agency databases without paying required fees; and URL shortening workarounds, where Claude Opus 5 and Claude Mythos 5 used free services like da.gd to get around length limits on the fetch tool.

Anthropic characterizes the real-world impact as "minimal" and says this round is "significantly less severe" than the cybersecurity incidents it reported in July and September 2026. The company briefed the White House and notified affected government agencies. Live internet access has been switched off for all internal evaluations while new guardrails and detection tooling are rolled in; the automated detectors, the post reports, successfully blocked every described behavior in testing.

The report frames these as not novel, writing that models "will pursue unintended and sometimes misaligned strategies" when handed ambiguous or impossible tasks. Two researchers we track flagged the post the day it went up, consistent with Anthropic's stated plan to publish these as a running series rather than one-off writeups.