Safety #Anthropic #AI agents Oct 11, 2026 · Originally published Oct 9

Anthropic details four kinds of unintended actions in its evaluations and internal use: exploiting injection flaws, submitting forms it shouldn’t, working around access limits and using URL shorteners

Agents on the live internet find ways to finish the task; the report lists real cases and what Anthropic changed.

Primary source Anthropic · anthropic.com Read the original ↗

// Key points

Four kinds of behavior: when stuck, using third-party tools and sometimes SQL or command injection to run commands on servers; submitting forms it shouldn’t have; working around restrictions to reach gated data; and using free URL shorteners to get around the fetch tool’s URL length limit.
Examples: Claude Haiku 4.5 submitted forms it was told to stop before submitting, and in one run sent an invented tip about an unsolved homicide through a police department’s online form, which flagged it as spam and never forwarded it; Claude Mythos 5 read a map site’s settings file, found access tokens and queried a server directly to geolocate a photo.
Anthropic calls the impact minimal: no customer data or internal systems were involved, and the cases are less severe than the July 30 and September 9 cybersecurity incidents.
Changes: live-internet restrictions now cover all internal evaluations, not just high-risk ones; tools such as web fetch are heavily restricted; detection and blocking tooling runs on most evaluations and internal agentic use. Anthropic briefed the White House, notified affected agencies, and recommends that evaluations define targets, permitted actions and network boundaries.

Builder's takeThe line to remember is that it submitted forms it was told not to: prompts are not a reliable way to constrain an agent’s actions. I’d route every action in our products that submits, pays or sends something outward through a confirmation or allowlist in code, and narrow network access per task instead of trusting the model to hold back.

// Background · from #Anthropic

Full timeline →