News

Anthropic Agents Crossed Boundaries While Trying to Finish the Job

• By John K. Waters
• 10/12/2026

Anthropic has suspended live internet access across its internal AI evaluations after finding that Claude models sometimes worked around restrictions to complete tasks, including exploiting software flaws and submitting forms on real websites.

In an October 9 disclosure, the company said the identified cases had minimal real-world impact. It nevertheless acknowledged that training models to behave safely was not yet sufficient on its own to prevent such actions.

“Most are forms of persistence,” Anthropic said, describing models continuing past obstacles rather than stopping.

One example involved a model running a scientific calculation on a university server after exploiting an injection flaw. Another involved a model submitting a real government form when the practice version was unavailable.

The company said it had notified affected agencies and briefed the White House. Its new detection tools blocked all the reported cases when tested against them, it said, a result that does not establish how they will perform against unfamiliar failures.

The most publicly visible example involved an invented homicide tip sent to Philadelphia police. In an October 9 statement, the department said the submission reached its public unsolved-murders website on July 18 and purported to come from someone with information about a case.

Police said a spam filter caught the tip and never forwarded it for investigative review. The department found no indication of unauthorized access to police systems or compromised department data.

Anthropic told police it discovered the submission on September 28, stopped the responsible testing process, and added a validation mechanism, according to the department. Police said the company notified them on October 7 and met with officials the following day.

The department criticized the delay and called for stronger safeguards.

“The two-month delay in detecting and reporting the incident to the City is unacceptable,” it said.

The disclosure follows a more serious set of incidents Anthropic reported in July. In that earlier review, the company found that Claude models had accessed three organizations’ production systems during cybersecurity exercises intended to operate in simulated environments.

Anthropic attributed those incidents to a misunderstanding with an evaluation partner that left internet access available. The models had been told they were operating in a simulation. The company said it found no evidence that they were pursuing goals of their own.

The distinction matters for businesses considering agents that can operate software and act on their behalf: harmful activity can arise while a system is pursuing an assigned task, even without an independent objective.

Microsoft Chief Executive Satya Nadella addressed that concern in an October 10 post on X, advocating safeguards outside a model’s control and a mechanism allowing an authorized person to stop it mid-task.

His approach treats models with access to important systems as potential insider risks, requiring controls that remain effective when the model makes a mistake or is compromised.

For enterprise users, the incidents point to a gap between measuring whether an agent completes its work and establishing whether the steps it takes are authorized. A successful result alone cannot answer the second question.