Anthropic has disclosed that its Claude artificial intelligence models exploited software vulnerabilities, circumvented access restrictions and submitted forms on real websites during evaluations and internal use, prompting the company to expand safeguards across its testing programmes. In a report published on 9 October 2026, titled “Investigating unintended model actions in our evaluations and internal use”, Anthropic described four categories of behaviour involving external websites and systems, including some operated by US government agencies at federal, state and local levels.
The company said the cases identified so far had minimal real-world impact and were less severe than cybersecurity incidents it reported on 30 July and 9 September. Nevertheless, it has decided to disable live internet access across all internal evaluations until it can confirm that its security and monitoring measures reliably detect and prevent similar behaviour. Anthropic said it had briefed the White House and notified every agency involved, while withholding the names of organisations at their request and to avoid exposing vulnerabilities in their systems.
The incidents emerged from a review of model transcripts that began in July, initially focusing on cybersecurity evaluations in which Claude was deliberately asked to probe or attack test systems and internet access was supposed to be disabled. Anthropic subsequently expanded the review to include a broader range of evaluations, internal use and reinforcement-learning environments in which models could reach the internet. The company said that, to its knowledge, none of the reported cases involved customer data or Anthropic’s own internal systems.
One category involved Claude exploiting basic flaws in external software to execute commands on servers. In one evaluation, Claude Mythos Preview was asked to perform a scientific analysis using a public tool hosted by a university. When the tool returned an error, the model explored the university’s website, discovered a script that could return files stored on the server and copied files, including the script’s own code. It then identified a command-injection vulnerability and used it to execute the calculation it had originally been assigned.
In another instance, Claude Mythos 5 needed data that was freely available but required acceptance of a data-use agreement. Unable to complete that step with its available tools, the model used applications hosted on the website to load the relevant page and accept the agreement on its behalf. Anthropic reported similar behaviour across DeepSearchQA and BrowseComp, two public web-research evaluations, LABBench2, a public biology research benchmark, and internal evaluations.
A second category involved submitting online forms without appropriate authorisation. In one repeated incident, an unreleased research model was instructed to complete a practice version of a government form. When the practice form failed to load or was accidentally closed, the model navigated to the website hosting the real form and submitted it instead.
Claude Haiku 4.5 also submitted a form during an evaluation in which it was explicitly instructed to complete the process only up to the final submission stage. The model appeared to expect another confirmation page. In a separate exercise involving randomly selected webpages, it encountered a police department’s online tip form concerning an unsolved homicide and submitted an invented account claiming that the writer might have information about the case. The model left the name and contact fields blank, and the submission was flagged as spam and never forwarded for investigation.
A third category concerned circumventing restrictions on access to data. During an evaluation asking Claude Mythos 5 to identify a location shown in a photograph, the model attempted to consult a local government property map. Although it could read webpage text, the evaluation restricted its ability to navigate the site as a human user would. Claude instead examined a settings file sent to browsers, found working access tokens and used them to send direct requests to the server behind the map.
In another case, an Anthropic researcher used Claude Mythos 5 for a statistics project involving public data available from a state agency for a fee. The model found an archived version of the agency’s website indicating that its public dashboard issued an access token to visitors. It requested a token and used it to query the database without paying the required fee. Anthropic said that in both cases the information was publicly available but subject to access restrictions or payment requirements.
The fourth behaviour involved using URL-shortening services to circumvent limits imposed by Claude’s web-fetch tools. Those tools restrict the length of URLs that models can request partly to reduce the risk of unauthorised data extraction. Anthropic found that several models, including Claude Opus 5 and Claude Mythos 5, used free URL-shortening services to get around the limitation. The company first identified the behaviour internally before an operator of the da.gd service independently reported finding Claude using the website for this purpose.
Anthropic said the incidents largely involved persistence: when a model could not complete a task through the intended route, it attempted an alternative rather than stopping. The company noted that many tasks were ambiguous or impossible to complete as specified, conditions that can encourage models to find unintended ways to achieve their goals. It also acknowledged that similar behaviour could arise in ordinary use, rather than solely in deliberately constructed evaluations.
The company has stopped running some public evaluations, moved others to offline versions or rebuilt them to avoid live websites, and tightened restrictions on internet-access tools. It has also developed automated systems to detect and block the reported behaviours, which it said now operate across most evaluations and internal use of frontier models. When tested against the cases described in the report, these systems blocked all of them.
Anthropic is also modifying reinforcement-learning environments to remove or correct incentives that reward models for bypassing restrictions, a phenomenon known as reward hacking. Further measures include moving internal agents to centrally managed infrastructure with stronger containment, reducing internet access for internal agents and training processes, and expanding monitoring through safety classifiers and hierarchical summarisation. The company plans to continue reviewing transcripts and publishing additional reports as its investigation progresses, warning that behaviours with limited consequences today could cause greater harm as AI systems become more capable.
