Anthropic admits Claude's improper actions on government sites

On Friday, October 9, Anthropic published a report detailing four types of unpredicted actions that Claude models executed on real websites and systems during evaluations and internal use. Some cases involved pages from federal, state, and municipal agencies in the United States. The company claims to have informed the White House and notified each affected agency. On the same day, according to Axios, the White House's frontier AI task force began requiring that all companies in the sector report and rectify incidents of this type.

What the models did

The most cited case involves Claude Haiku 4.5. In a random page navigation task, the model encountered a site about an unsolved homicide and submitted a fabricated report through the police form. The system flagged the message as spam, and it never reached investigators. The Philadelphia Police Department made the case public in a statement, and Anthropic claims to have relayed the discovery to the corporation on October 8.

The other three groups are more significant for those operating agents in production. Claude Mythos 5, while attempting to access a local government's property map, read the browser's configuration file, found valid access tokens, and began querying the server directly. In another case, Mythos Preview, blocked in an analysis tool hosted by a university, exploited an injection flaw to run commands on the server. Claude Opus 5 and Mythos 5 also used free URL shorteners to bypass the search web resource size limit, a restriction designed precisely to block long addresses capable of carrying malicious instructions.

A not-yet-released search model, unable to load the training copy of a government form, went to the actual site and submitted the real form multiple times during the same evaluation. According to a State Department official cited by Axios, a test model from Anthropic submitted 19 non-immigrant visa requests in August and one in May through the agency's public form. None were processed, and the official stated that the department’s systems were not compromised.

Company and government responses

Anthropic classifies the cases as having "minimal real-world impact" and does not specify how many executions were affected. Following the announced measures, live internet access restrictions, previously limited to high-risk evaluations, have been extended to all internal assessments. Public tests that involved real sites were suspended, migrated to offline versions, or reconstructed. The company has also restricted the use of the web search tool and states that its new detection layer, applied to most assessments and internal use of agents, blocked all the reported cases when tested against them.

On the Washington side, the task force overseeing frontier AI at the White House, according to Axios, described the notification and rectification of incidents as a national security obligation, applicable to all AI companies, not just Anthropic. The statement did not specify a compliance mechanism or penalties for non-compliance. Until now, the federal requirement to report incidents existed only as a bill: the AI Incident Reporting Act, introduced by Representative Nathaniel Moran in June, mandates reporting to the Department of Commerce within seven days.

Where the rule already exists and where accountability arrives

The European Union is a step ahead in regulation. The AI Act requires providers of general-purpose models with systemic risk to report serious incidents to the AI Office starting in August 2025. A laboratory operating in both markets now responds to two regimes, one with legal grounding and the other sustained by political pressure, without a definition of when each is enacted.

In Brazil, the relevant channel is the LGPD. Resolution CD/ANPD No. 15, of 2024, requires the controller to communicate security incidents with relevant risk within three business days. A Brazilian company whose agent accesses third-party data through a shortcut like that of property map tokens inherits this obligation, regardless of who trained the model.

For CIOs and CISOs, the report shifts the framing of the problem. The incidents did not stem from malicious customers or external attacks. They arose from the manufacturer’s own testing environments, with dedicated security teams. Agent supply contracts typically treat evaluation and production as separate realms. Anthropic's document shows that, for an agent with web access, this separation only exists if someone controls the outgoing traffic and that it may take suppliers months to identify what the model did: according to the police, the false report was sent in July and was only traced back to the model in October.