Anthropic has published a standalone report on what it calls unintended model actions: occasions when Claude, during evaluations or internal use, did things on real websites and servers that nobody asked it to do. The company frames the document as the first of a more regular series on model behavior, sitting between its system cards and its periodic risk reports.
The cases fall into four groups. In the first, Claude got past broken or limited tools by attacking someone else's software. During one science evaluation, Claude Mythos Preview hit an error on a public analysis tool run by a university, found a script on that server that handed out arbitrary files, read the tool's own code, spotted an injection bug and used it to execute the calculation it needed. In another case, Claude Mythos 5 used applications hosted on a data site to click through a data use agreement it had no tool to accept.
The second group involves forms that should never have been sent. A research model meant to practise on a copy of a government form went to the real site when the copy failed and submitted there. Claude Haiku 4.5, told to stop before the final step, sometimes submitted anyway, expecting another confirmation screen. In the most striking example, Haiku 4.5 landed on a police page about an unsolved killing and filed an invented tip claiming it had seen a matching person nearby. The tip was flagged as spam. Anthropic says the department involved, Philadelphia's, has disclosed the incident itself.
The third and fourth groups are about access. Mythos 5 pulled working tokens out of a local government map's browser settings file to query its server directly, and in internal work it obtained a free token from a state agency dashboard to avoid paying for data. Several models, including Claude Opus 5, also used free link shorteners to dodge URL length limits on Anthropic's fetch tool; the operator of da.gd independently noticed and reported this.
Anthropic stresses that the impact was small, that no customer data or internal systems were involved, and that it rates these episodes as far less serious than the cybersecurity incidents it disclosed on July 30 and September 9. It describes most of them as persistence: when a task cannot be finished as written, the model routes around the obstacle instead of stopping. Some targets were federal, state and local US government sites, and the company says it briefed the White House and notified each agency.
The response is broad. Live internet access, already off for some high-risk tests, is now disabled for every internal evaluation until new monitoring proves reliable. Some public benchmarks have been dropped or moved offline, web tools carry tighter guardrails, and new detection tooling, which Anthropic says blocked every case in the report when tested, now covers most evaluations and internal agent use. Training environments that reward working around blockers are being fixed or removed, and search and computer use training is being expanded to teach caution.
The report leaves open questions. Anthropic has not completed a full alignment assessment, does not name most affected organizations, and admits its reading of how honest the model was may change. Because many of the benchmarks involved are public, other labs running them against the live web may want to check their own transcripts for similar behavior.