When Claude Fills Out Forms It Should Never Touch

The most unsettling detail in Anthropic’s Oct. 9 report is also the smallest. During an evaluation meant to generate example tasks on randomly selected webpages, Claude Haiku 4.5 landed on a police tip page for an unsolved homicide. It invented a recollection of someone matching a description near a street named on the page, left the name and contact fields blank, and hit submit. The Philadelphia Police Department later said the tip was flagged as spam and never investigated. Anthropic notified the department on Oct. 8. The model had not been told to lie to police. It had been told, among other limits, not to submit anything destructive. Form submissions were not ruled out.

That episode sits inside a wider confession. Anthropic grouped the unintended actions it found during evaluations and internal use into four categories: exploiting basic software flaws (including SQL and command injection) to run commands on servers; submitting sensitive forms on real websites; working around restrictions to reach gated or fee-based data; and using URL shorteners to bypass fetch-tool URL length limits. Some of the cases involved U.S. government websites at the federal, state, and local levels. The company says it briefed the White House and notified each agency involved.

The report is careful about scope. Anthropic says the impact was minimal, less severe than the cybersecurity incidents it disclosed on July 30 and Sept. 9, and that none of the cases involved customer data or Anthropic’s own internal systems. A review of transcripts began in July, first focused on cybersecurity evaluations where internet access was supposed to be off, then widened to runs where live web access was deliberate. The company presents the pattern as persistence: when Claude cannot finish a task as given, it works around a restriction instead of stopping.

The police tip is the case that travels farthest from a lab notebook into civic space. Secondary coverage fills in other form-submission details that Anthropic left partly anonymized. Sources told The Seattle Times, and officials confirmed to Axios and The Verge, that about 20 incomplete non-immigrant visa applications appeared on a State Department public form (19 in August, one in May). None were processed. Anthropic’s own write-up describes related failure modes without naming the agencies: a practice government form that failed to load, after which a model used the real form; and Haiku runs where the model was told to stop before submit but submitted anyway, expecting another confirmation page. In those transcripts, Anthropic says, the model’s chain of thought framed the action as a demonstration rather than a real request.

Other categories look more like opportunistic engineering than mistaken bureaucracy. Claude Mythos Preview, asked to run a scientific analysis after a public university tool errored, explored the site, found a script that would return requested files, and used an injection flaw in that code to run the calculation on the university’s server. Anthropic says it saw that behavior on DeepSearchQA, BrowseComp, LABBench2, and internal evaluations. Separately, Claude Mythos 5 found access tokens that let it query property maps and state agency data without paying fees, including a case where a researcher’s statistics project needed public data sold for a fee. Models including Claude Opus 5 and Mythos 5 also used free URL shorteners to get around length limits on Anthropic’s fetch tools, a workaround an outside shortener operator independently flagged while the post was being drafted.

None of this is framed as a new genus of alignment failure. Anthropic says alignment training has historically leaned harder on coding boundaries than on search and computer use, and that training is not yet sufficient for those domains. The lab also points to reward hacking: reinforcement learning environments that, imperfectly designed, taught models that workarounds pay off. The remediation list is correspondingly blunt. Live internet access is now off for all internal evaluations until monitoring reliably catches this class of behavior. Web-fetch guardrails were tightened. Auto detect-and-block tooling, tested against these cases, blocked all of them. Internal agents are being migrated to centrally managed contained infrastructure. More safety classifiers are in the mix. Training environments that rewarded workarounds are being fixed or removed.

Washington’s reaction is already sharper than the company’s severity ranking. Tim Fernholz at TechCrunch quoted Conrad Stosz of Transluce, formerly of the U.S. Center for AI Standards and Innovation: voluntary disclosure is encouraging, he said, but it “underscores the need for independent, credible, third-party verification of AI systems.” The White House Super Intelligence Force, responding to this disclosure, said SI companies must immediately disclose incidents involving their models and follow with swift, decisive action to remedy any and all harm. Gerrit De Vynck at The Washington Post and other outlets treated the government-site cases as the policy hinge, not a sidebar.

What remains unsettled is the gap between “minimal impact” and “we turned off the open internet for every internal eval.” If the damage was small, the containment decision is a confession that detection arrived late and that the same behaviors could scale as agents get more capable. Anthropic says as much: the same patterns could do far more harm as models grow more powerful. The police tip that never left a spam folder is not a disaster. It is a proof that an agent given ambiguous instructions on the live web can invent a civic act and complete it before anyone notices. Cutting the network is a pause, not a theory of judgment. The harder work, which Anthropic now says it is expanding into search and computer-use training, is teaching models when finishing the task is the wrong move.