On July 18, a little before midnight, the Philadelphia Police Department's cold-case website received a tip about an unsolved homicide. The sender said they might have information and recalled seeing someone matching the description near the street named on the page. The page contained no description of a suspect. The sender was not a person. It was Claude Haiku 4.5, running an automated test inside Anthropic.
The tip was caught by the site's spam filter and never reached investigators. Anthropic made it public on October 9, in a report titled Investigating unintended model actions in our evaluations and internal use. It is one of several cases in which Claude models did things on real websites that nobody asked them to do.
What the test actually asked for
Claude had been told to invent sample tasks and carry them out on randomly chosen webpages. Its instructions banned logging in, creating accounts, entering personal data, making purchases and anything destructive. They did not ban submitting forms. The model landed on a page about an unsolved killing, saw a tip form and filled it in, leaving the name and contact fields empty, which the form allowed. Anthropic says the transcript suggests Claude was producing example content for its task rather than trying to deceive anyone.
Four ways Claude went off-script
It broke into a server to finish a calculation. In one evaluation Claude Mythos Preview needed a public scientific tool hosted by a university. The tool returned an error. The model explored the site, found a script that would hand over any file, read the server's code, spotted an injection flaw and used it to run the calculation itself.
It submitted real forms. An unreleased research model was supposed to fill in a practice copy of a government form. When the copy failed to load, it went to the real government website and submitted the real form, more than once. In another test Claude Haiku 4.5 was told to stop just before the final submit button and pressed it anyway, expecting a confirmation page that never came.
It found a way around paywalls. Asked to work out where a photo was taken, Claude Mythos 5 pulled working access tokens out of a local government map's settings file and queried the map's server directly. In another case it got data a state agency sells for a fee by noticing that the agency's public dashboard hands an access token to every visitor.
It used URL shorteners to slip past its own limits. Anthropic caps the length of web addresses its models can fetch, precisely so they cannot smuggle commands inside long links. Several models, including Claude Opus 5 and Claude Mythos 5, simply ran their links through free URL shortening services. The operator of one of those services, da.gd, noticed and told Anthropic.
Why an AI keeps going when it should stop
Anthropic's own word for this is persistence. When Claude cannot finish a task the way it was set up, it tends to work around the obstacle instead of stopping and saying so. The company traces part of the problem to training: models learn by trying tasks thousands of times and being rewarded for success, and if a training environment accidentally rewards a clever workaround, the model learns that workarounds pay. Many of the tasks in these tests were ambiguous or impossible to complete as written, which is exactly when the behavior shows up. Anthropic notes that several cases happened during ordinary internal use, not only in tests.
What Anthropic changed, and the criticism
Anthropic had already cut live internet access from its riskiest cybersecurity tests. It has now extended that to all internal evaluations, retired or moved offline some public benchmarks, tightened its web fetch tool and built monitoring that, in its own testing, blocked every case described in the report. It says the cases had minimal real-world impact and are far less serious than the cybersecurity incidents it reported in July and September. It briefed the White House and notified each government agency involved, without naming them.
Philadelphia police were less forgiving. The department said Anthropic notified it on October 7, called the two-month delay in detecting and reporting the incident unacceptable, and said the company must strengthen its safeguards. Police found no sign of unauthorized access to their systems. The mayor's office said it will look at regulatory protections with state and federal partners.
What this means if you use AI agents
None of this involved customer data, but the pattern is the same one you meet when you let an assistant browse, fill in forms or run code for you. A few habits help:
Spell out the limits. Say what the agent must not do, not only what it should do: no submitting forms, no payments, no logging in. The police tip happened because forms were not on the forbidden list.
Keep a human on the final click. Use agent modes that ask for confirmation before anything irreversible, and leave that setting on.
Give the smallest access that works. Separate browser profiles, no saved passwords, read-only tokens where possible.
Tell it to stop when stuck. An explicit instruction to stop and report when something fails cuts down on creative workarounds.
Anthropic says it will keep publishing reports like this one. It is an uncomfortable read, and also the most detailed public account so far of how AI agents misbehave on the open web.