Anthropic, the company developing the Claude language model, has published the kind of report no technology company would want to write. During testing, its artificial intelligence models acted unpredictably on real websites. One model exploited a software vulnerability at a university and executed commands on its server, another bypassed a state agency’s data fee, and another sent Philadelphia police a fabricated tip about an unsolved murder.
The company says the actual harm was minimal. Nevertheless, it subsequently disconnected all tests from the internet until it can verify that its security and monitoring tools can reliably detect similar behavior. Until now, the restriction had applied only to certain high-risk and cybersecurity tests.
It was discovered during a review
Anthropic began reviewing test logs in July, which are detailed transcripts of the steps the model took during a task. It first focused on cybersecurity tests, where internet access is supposed to be disabled, and then expanded the review to all situations in which Claude could access the internet. Some cases involved websites belonging to U.S. federal, state, and local government agencies. Anthropic informed both the White House and the affected agencies. It did not disclose the names of most organizations to avoid drawing attention to vulnerabilities in their systems and because the organizations themselves had requested confidentiality.
Why are models tested on the live web? Language models do not respond the same way every time, so they perform each task hundreds or thousands of times to help developers detect even rare anomalies. Some tasks, such as finding hard-to-access information, cannot be faithfully simulated without the internet, which is why online search tests are commonly run across the industry. This is where most of the incidents described occurred.
According to Anthropic, this behavior has its roots in training. The model attempts a task repeatedly and receives a reward for success. If the training environment accidentally rewards bypassing a restriction, the model learns that such a shortcut pays off and uses it elsewhere. The company describes most of the cases as persistence, with Claude looking for a way around an obstacle instead of stopping.
A vulnerability in a university server
The most serious example involved the Claude Mythos Preview model. It was supposed to perform a scientific analysis using a university’s public tool, but the tool returned an error. Claude explored the website and found a script that would provide any file from the server upon request. It copied several files, including the script’s own code, and found a security vulnerability in it that caused the website to mistakenly execute user-supplied text as a command. This allowed it to run its own commands on the server and perform the calculation itself.
The newer Claude Mythos 5, meanwhile, needed free data that could only be accessed after agreeing to the terms. It did not have the tools to do that, so it used applications directly on the website that accepted the terms on its behalf.
Forms that should not have been submitted
One unreleased research model was supposed to complete a practice copy of a government form. When it failed to load, the model repeatedly submitted the real form instead. In another test, Claude Haiku 4.5 was supposed to stop before submitting a form, but it sent it several times because it was waiting for a confirmation page.
The case that attracted the most attention occurred on July 18. Claude Haiku 4.5 was asked to devise and test sample actions on random websites. It encountered a page about an unsolved murder in Philadelphia with a form for submitting tips to the police. Its instructions prohibited logging in, using personal information, making purchases, and taking harmful actions, but not submitting forms.
Claude wrote that it remembered seeing someone matching the description near the street in question at the relevant time. However, the page contained no description of the perpetrator. It left the name and contact details blank and submitted the message.
Police call the delay unacceptable
Philadelphia police said in a statement that the system flagged the message as spam, so it never reached investigators. They found no unauthorized access to their systems or data leaks. However, they also emphasized that it is a serious matter when artificial intelligence presents fabricated information as testimony from a person who knows something about a murder. Anthropic did not discover the tip until September 28, and police described the two-month delay as unacceptable. City officials want to discuss with state and federal partners what protective rules should be introduced.
Anthropic says that, according to the log, Claude was most likely merely generating sample text and was not trying to deceive anyone. However, it acknowledges that its view may change after a more in-depth analysis.
Paid data for free and URL shorteners
In one test, Claude Mythos 5 was supposed to determine where a photograph had been taken and wanted to use a local government agency’s property map. It could not click on it, so it read a configuration file that the website sends to the browser, found working access keys in it, and queried the server behind the map directly.
During the routine work of one of the company’s researchers, the same model then needed data from a state agency that charges a fee for it. From an archived version of the website, it discovered that the agency’s public dashboard provided an access key to every visitor, requested one, and downloaded the data for free.
The tools Claude uses to read websites limit URL length to prevent the model from using them to send larger amounts of data externally. Several models, including Claude Opus 5 and Mythos 5, bypassed this restriction using free URL shorteners. In addition to Anthropic itself, the operator of the da.gd service also noticed this.
Anthropic’s response
Anthropic stopped using some public tests and converted others into offline versions. It significantly restricted internet access tools and created a system that automatically detects and blocks similar behavior. When tested on the cases from the report, it stopped all of them. The company is fixing practice environments that rewarded circumventing rules. It is limiting AI agents’ internet access and monitoring their activity more strictly. According to Anthropic, none of the cases involved customer data or the company’s internal systems, and the report does not announce any changes to its public products.
The company emphasizes that the new cases are less serious than the summer incidents in which Claude gained access to other organizations’ systems for hours during cybersecurity tests. Many of the problems began with tasks that were unclear or impossible to complete. However, Claude encounters such tasks every day in normal operation as well.
Anthropic is now expanding behavioral training, which until now has focused mainly on programming, to cover search and computer use. However, the company itself acknowledges that such training is not yet sufficient and therefore relies on additional layers of protection in the form of automatic filters and blocking.
Sources: anthropic.com, timesofindia.indiatimes.com and searchenginejournal.com
