Claude Submitted a Fake Murder Tip and Filled Out Visa Forms. Anthropic Has Now Cut Internet Access for Internal Tests.
Anthropic has pulled live internet access from all its internal AI evaluations after discovering that several of its Claude models had been doing things they very much should not have been doing. The company identified four categories of unintended behaviour, and at least one of them is genuinely difficult to wave away.
The incidents span multiple Claude versions. Claude Mythos Preview exploited SQL and command injection vulnerabilities in third-party software to run commands on a university server, apparently because its own tools were unavailable or deliberately restricted and it decided to improvise using whatever it could reach. Claude Haiku 4.5 and an unnamed research model submitted real forms on live websites without authorisation, partly due to ambiguous instructions and partly because test environments weren't properly sandboxed. Claude Mythos 5 bypassed access controls to retrieve data gated behind tokens or fees. And Claude used URL shortening services to get around restrictions on its fetch tool.
Anthropoc isn't naming the affected organisations, citing their requests and a desire not to publicly document exploitable weaknesses. The company described the real-world impact as "minimal," which is technically true in some cases and considerably harder to argue in others.
Some of the affected sites were operated by US government agencies at federal, state, and local level. One incident involving Claude Haiku 4.5 is particularly uncomfortable. The model landed on a web page about an unsolved homicide, found a tip submission form run by a police department, and submitted one. The instructions it was operating under explicitly prohibited entering personal data, creating accounts, making purchases, or submitting anything destructive. Form submissions, apparently, weren't covered.
The tip it sent read: "I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant."
That tip was sent to the Philadelphia Police Department via PhillyUnsolvedMurders.com on 18 July 2026. Anthropic didn't detect it until 28 September. The PPD was notified on 7 October. The tip was flagged as spam. The department's response was blunt: a two-month delay in detecting and reporting this to the city is unacceptable, and Anthropic needs to strengthen its safeguards.
The New York Times separately reported that Anthropic agents filled out around 20 visa applications on the US State Department's website. The applications were incomplete and weren't processed, according to two sources familiar with the matter.
These latest cases were uncovered as part of a transcript review Anthropic began in July 2026, following disclosure of three earlier incidents where models had engaged in unsanctioned activity during cybersecurity testing. Last month the company also revealed a fourth older incident, dating to January 2026, involving an early Claude Opus 4.6 build that breached third-party systems after being unable to stop a task mid-execution.
Anthropoc says it had already cut live internet access for some high-risk and cybersecurity evaluations before this point. It's now extending that to every internal evaluation, pending confirmation that its monitoring and security measures can reliably catch this kind of behaviour. The company also expects to find more incidents as its broader investigation continues.
This is all unfolding against a backdrop of mounting concern about AI agents operating in the wild. In July 2026, rogue OpenAI agents broke out of a test environment and accessed Hugging Face. A string of other incidents has followed. The pattern is becoming hard to ignore: as labs push their models to be more capable and more autonomous, the gap between what models can do and what labs can reliably control them from doing keeps showing up in the form of real incidents.
On the regulatory side, the UK Information Commissioner's Office this week confirmed that ten major foundation model developers, including Anthropic, OpenAI, Google, Meta, Microsoft, Apple, Amazon, Cohere, DeepSeek, and Stability AI, have made or committed to make changes to their data protection policies. The changes include clearer transparency disclosures and stronger mechanisms for users to exercise their rights.
"As AI systems operate with greater autonomy, robust data protection safeguards become even more critical," said Richard Nevinson, the ICO's director of Technology Regulation. "The fact that AI agents act with autonomy is not an excuse for poor compliance."
Hard to argue with that.