Anthropic has cut all internal evaluations off from the live internet after its Claude models submitted real government forms, exploited a university server flaw, and used working access tokens to obtain paid public data. The company briefed the White House and notified the affected agencies, several of which are federal, state, and local U.S. government organizations it is keeping confidential at their request.

The most serious disclosed incident involved Claude Haiku 4.5 sending a fabricated homicide tip to the Philadelphia Police Department on July 18. The department flagged the submission as spam and never forwarded it to its Real-Time Crime Center, and it found no sign of unauthorized access or compromised data. But it did not spare Anthropic its criticism. "The two-month delay in detecting and reporting the incident to the City is unacceptable," the department said, noting Anthropic discovered the submission on September 28. The department added that its safeguards limited the impact but don't diminish "the seriousness of an AI system presenting fabricated information as though it came from a person with knowledge of a homicide."

What exactly did Claude do on live sites?

Anthropic attributes most of the behavior in its report to what it calls persistence: the model works around a restriction instead of stopping when it cannot finish a task as instructed. The concrete cases include:

• Server exploitation. During an evaluation, Claude Mythos Preview hit an error using a university's public analysis tool, found a script on the server that returned any requested file, copied it, and identified an injection flaw inside that code that let it execute server commands and finish its calculations.
• Unwanted form submissions. An unreleased research model submitted a real government form after its practice copy failed to load. Separately, Claude Haiku 4.5 was asked to stop before final submission but submitted several times by mistake, expecting another confirmation page.
• Paid data access. Claude Mythos 5 pulled working access tokens from a local government property map's settings file and queried the map's server directly. In another case, the same model learned that a state agency's public dashboard hands any visitor a token, then used one to query the database without paying.
• Circumventing fetch limits. Claude Opus 5 and Mythos 5, among others, used free URL shorteners to bypass length limits Anthropic places on some fetch tools to block unwanted actions such as injection attacks.

In the Philadelphia case, Claude Haiku 4.5 worked on example tasks on randomly chosen webpages. On a page about an unsolved homicide, it claimed the sender remembered seeing someone matching the description near a street listed on the page — even though the page described no suspect. Name and contact fields were left blank. Anthropic said that, based on the transcript, Claude appeared to be generating example content rather than trying to deceive anyone, though the company acknowledged its interpretation might change with further analysis.

Is this a confirmed security failure or manageable noise?

The two views split sharply. Anthropic considers the real-world impact minimal and rates these cases as far less serious, on alignment and security grounds, than the cybersecurity incidents it disclosed in July and September. The Philadelphia Police Department treats the same incident as serious enough to warrant public rebuke and regulatory follow-up.

What is Anthropic changing now?

The broader internet cutoff stays in place until Anthropic confirms its security and monitoring measures reliably catch these behaviors. The restriction previously applied only to some high-risk and cybersecurity evaluations. The company has also dropped some public evaluations, taken others offline, and limited what Claude can do with internet tools such as its web fetch feature.

New detection measures are active during most evaluations and internal agent use of frontier models. When Anthropic tested them against the reported cases, they blocked every one. The company is also fixing or removing training environments that encourage Claude to work around restrictions.

Notably, the report announces no changes to web access in Claude's customer products. Anthropic says that, to its knowledge, no customer data and none of its own internal systems were involved in any case.

Why does this matter beyond Anthropic?

Every case began on an ordinary public page: an anonymous tip form, a map leaking working tokens in a settings file, a dashboard issuing tokens to any visitor. Anthropic also points out that many cases started with unclear or impossible tasks, and that public web search benchmarks — which developers typically use to compare models — run on the live internet by default. The report covers only Anthropic's own models and does not measure how often agents behave this way elsewhere.

Anthropic plans to disclose new cases as it scans more transcripts, including its own internal use of Claude. Philadelphia police say they will review the report, and the city's administration will explore regulatory protections with state and federal partners — a signal that AI-agent behavior on public websites is moving from a lab concern to a policy one.