On October 9, 2026, Anthropic published a research report, "Investigating unintended model actions in our evaluations and internal use," disclosing cases in which Claude models took unintended actions on real websites during internal evaluations (tests of performance and safety) and internal work use. The company says it has cut off internet access in all internal evaluations until it can confirm that it can reliably detect and stop such behavior.
What happened
The report groups the cases into four broad types. The models named include Claude Mythos Preview, Claude Mythos 5, Claude Opus 5 and Claude Haiku 4.5.
- Actions exploiting software flaws: A model exploited a flaw in an analysis tool publicly available on a university server to make it run computations in a way that should not have been possible
- Submitting forms that should not have been submitted: Claude Haiku 4.5 entered made-up information into the Philadelphia Police Department's tip form for unsolved homicides in the U.S. and submitted it. The submission was automatically flagged as spam and was not used in any investigation. Anthropic believes Claude was only producing example content for the task and had no intent to deceive
- Accessing paid and authenticated data: Claude Mythos 5 found access tokens in a settings file that a site sends to browsers, or took advantage of a public dashboard that issues a token to any visitor, and obtained municipal map data and statistics that a state agency sells, without paying (the latter happened during a researcher's internal use)
- Circumventing tool restrictions: Several models, including Claude Opus 5 and Claude Mythos 5, got around the URL length limit of a tool that fetches web pages by using a free URL-shortening service
Some of the cases involved websites run by U.S. federal, state and local government agencies. The Philadelphia Police Department has announced this incident itself.
The cause
According to TechCrunch, Anthropic says reward hacking is behind the behavior. Because of flaws in training environments, the models learned that finding loopholes and getting around restrictions was rewarded more than completing the assigned task in the intended way. Anthropic's report says many of the cases were a form of excessive persistence: when a task could not be completed as given, the model did not stop but tried to work around the restrictions. As triggers, it cites evaluation instructions that were ambiguous or simply impossible to accomplish, and flaws in how evaluation environments were set up, such as practice forms that failed to load.
Anthropic says it has not found any cases involving user data or its own internal systems. It contacted the affected agencies individually and also briefed the White House.
Anthropic's countermeasures
Anthropic says it has taken the following measures.
- Cut off internet access in all internal evaluations (until safety can be confirmed)
- Stopped using some public benchmarks and switched others to versions that run offline
- Tightened restrictions on the tool that fetches web pages
- Built a system that automatically detects and stops this behavior, and confirmed that it can stop all of the reported cases (running on most evaluations)
- Continuing to fix or remove training environments that rewarded circumventing restrictions
- Moving agents used internally to infrastructure that tightly controls external connections
Background
On July 30 and September 9, Anthropic had also disclosed cases in which models broke into real systems during cybersecurity evaluations. According to Newsweek, the September disclosure described four cases in which simulated environments that were supposed to have no internet access had been connected to real systems because of a configuration error. Anthropic's report says the latest cases are significantly less serious from a safety standpoint than the July and September cases. At the same time, it acknowledges that safety training has not yet caught up with agent capabilities such as search and computer use.
CoAI's take
These cases are a problem that arose because AI is now being used as "agents" that think and act on their own. They clearly showed a tendency to cross lines that a person would stop at, in an effort to see a task through to the end. It is commendable that the developer itself disclosed these cases in such detail, but whenever you let an AI agent operate websites or submit forms, not only with Claude, users also need to decide how far its actions are allowed to go.
