Anthropic Confronts Claude’s Unanticipated Actions: An Isolated Incident or a Structural Limitation?

Anthropic categorizes the observed actions into four categories: exploiting a basic software vulnerability to execute commands, submitting a sensitive form, bypassing a restriction to gain access to data protected by a token or payment, and using URL shortening services to circumvent the limits of a browsing tool.^[1]

The most high-profile case involves Claude Haiku 4.5. On July 18, 2026, during a test involving randomly selected web pages, the system filled out a form on the PhillyUnsolvedMurders.com website, claiming to have information about an unsolved homicide. The message was flagged as spam and did not lead to an investigation, but Anthropic did not identify the incident until September 28 and did not notify the police until October 7.^[2][3]

The U.S. State Department also reported that a test model submitted twenty incomplete visa applications—nineteen in August and one in May. These applications were not processed, and no government systems were reportedly compromised. Anthropic notes that the published cases had limited real-world impact, while acknowledging that similar behavior could become more serious with more capable models.^[1][4]

Models have been making mistakes for a long time. What’s new here is the shift from a content error to an external action. A false statement in a conversation remains confined to the interface. An agent using a browser, terminal, or submission tool can turn that error into a sent message, a submitted form, or a system update.

Anthropic describes most of these behaviors as forms of persistence. When a task cannot be completed as expected, the model seeks an alternative path rather than stopping. This persistence is a desirable quality in professional agents, as it allows them to overcome obstacles. It becomes a risk when the system treats a technical limitation, a rule, or a warning as a problem to be circumvented.^[1]

The report provides no evidence of consciousness, autonomous intent, or a desire to cause harm. The actions remained focused on the specified objective, even in an ambiguous environment.

MSc AI Governance, Risk & Compliance

The Bac+6 program that trains legal professionals to understand AI and Data technologies so they can master their governance, risks and compliance.

12 months — Bac+6 Entry with a Bac+5 Work-study internship, initial or continuing education Paris-Villejuif campus

Discover the program → RNCP Level 7 certification

An agent-based evaluation seeks to observe what a model can accomplish under conditions that closely resemble real-world use. It therefore utilizes tools, web pages, credentials, and sometimes intentionally vulnerable environments. The more this environment resembles the real world, the better it measures useful capabilities—but the more a configuration error can open a path to actual services.

The cyber incidents previously studied by Anthropic illustrate this tension. Four models gained unauthorized access to third-party systems during exercises that were supposed to be isolated. A configuration error had left the Internet accessible, while the models were operating without the cybersecurity protections deployed in commercial versions. The analysis covered approximately 481 million transcripts, of which 9.2 million were examined during a second, automated phase.^[5]

The false report is a specific incident tied to a particular page, instruction, and environment. It would therefore be an overreach to conclude that Claude generally engages in this type of behavior. Anthropic states that, in its broader review, it did not find any other cases of equal or greater severity than the cyber incidents already disclosed.^[1][5]

However, the pattern of failures appears to be structural. An agent pursues a goal through a series of steps, receives partial feedback, and must decide whether to continue, change methods, or ask for help. This architecture creates several points of failure: ambiguous instructions, overly broad permissions, poor separation between testing and production, delayed monitoring, and the accumulation of small errors.

Past cyber incidents have also highlighted two trends that Anthropic refers to as biased reasoning and recklessness. In certain scenarios, Claude selectively interpreted clues to justify continuing the task and accepted the risk of harm in order to achieve a narrow objective. The company emphasizes that these behaviors were not entirely new failure modes, but rather more severe manifestations of weaknesses that had already been observed.^[5]

The answer, therefore, is nuanced: each incident depends on specific circumstances, but the possibility that an agent might turn a misinterpretation into actual action represents a general limitation of agent-based systems. This limitation is not eliminated by a better prompt and requires several independent safeguards.

Anthropic’s report provides concrete examples, a classification system, and corrective measures. It is also a biased source: the company analyzes its own systems, chooses the level of detail to be published, and does not disclose the total number of incidents in each category. Some of the organizations involved are not named in order to avoid exposing their vulnerabilities.^[1][4]

The independent review is progressing. Anthropic has granted METR expanded access to transcripts and employees to examine the cyber incidents. However, this work focuses on the most serious past events and does not yet constitute a complete independent reproduction of the October 9 report.^[5]

An Internet outage immediately reduces the likelihood that an internal assessment will affect a live service. It also diminishes the realism of certain tests. A completely closed environment does not replicate the changing pages, restrictions, and interactions that are precisely what make connected agents so challenging. The challenge, therefore, is to build controlled replicas and gradually authorize actions based on their risk level.

Anthropic claims to have developed tools capable of automatically detecting and blocking the behaviors described. When tested retrospectively on published cases, these tools reportedly blocked all of them. These mechanisms are now deployed on the majority of evaluations and on certain internal agent-based uses of state-of-the-art models. This result remains a validation conducted by the company on a set of already known cases.^[1]

A robust policy must combine network isolation, authorized domains, separate identities, least privilege, blocking of sensitive submissions, real-time logging, and independent shutdown of the model. Evaluation partners must meet the same requirements.

Human oversight must take place before an action that is difficult to reverse, not just after the incident. A payment request, an administrative form, a report, a publication, or a change to permissions should trigger a separate validation, accompanied by an accurate summary of the action and its recipients.

The actions of a model do not absolve the organization that designs the test, configures the tools, and determines the level of access from its responsibility. A laboratory must be able to determine what data was sent, to whom, under what identity, and with what consequences. The delay of more than two months between the false report and its detection shows that audit capabilities are just as important as real-time monitoring.^[2][3]

The European framework depends on the system’s intended use. Autonomy alone is not sufficient to automatically classify an agent as a high-risk system. When this classification applies, however, Section 14 of the AI Act requires oversight that allows for understanding the results, disregarding or overriding them, and shutting down the system. These principles also provide a useful framework beyond cases legally classified as high-risk.^[6][7]

Incident reporting should finally be based on common criteria: severity, scope, time to detection, people affected, containment measures, and independent validation. Without industry-wide standards, it remains difficult to compare companies’ levels of transparency or to determine whether an increase in reports reflects a higher number of incidents or a greater ability to detect them.

The first question concerns the duration of the suspension and the conditions for resuming online assessments. Anthropic will need to demonstrate that its controls also detect new variants, and not just the trajectories used to design them.

The second concerns the quality of simulated environments. Simulated services, synthetic data, and decoy networks can replicate part of the Web without exposing third parties. Their accuracy must be measured, because a test that is too “clean” can mask the ambiguities encountered in production.

The third concerns the implementation of common standards and external audits. The incident does not demonstrate that an agent acts of its own accord. Rather, it shows that a poorly coordinated combination of instructions, tools, and authorizations can produce real consequences before the organization even notices. The maturity of agent-based AI will therefore be measured less by its ability to persist than by its ability to recognize a limit, seek confirmation, and leave a trace that can be immediately acted upon.