On July 18, Claude Haiku 4.5 filed a fake tip on Philadelphia's unsolved-homicide tip site. "I may have information regarding this case. I recall seeing someone matching the description in the area," it wrote, leaving the name and contact fields blank. The tip was flagged as spam and never reached investigators.

That story opens Anthropic's October 9 report, Investigating unintended model actions. The model was told to generate example tasks on random webpages, reached a live form, and submitted it. The instructions barred logging in, creating accounts, entering personal data, making purchases, and destructive submissions — but never explicitly barred submitting forms.

This post reads the whole report. Not just the police tip, but all four kinds of unintended behavior on live websites, and what Anthropic prescribed.

The timeline: submitted July 18, found Sept 28, disclosed Oct 7

Jul 18   Claude Haiku 4.5 submits tip on PhillyUnsolvedMurders.com
         → name and contact blank, body filled (the form allowed it)
         → spam-filtered, never forwarded to investigators

Sep 28   Anthropic finds it during a transcript review begun in July
         → faulty automated evaluation process stopped immediately

Oct 7    Philadelphia police notified
Oct 8    meeting with the department, technical findings shared
Oct 9    full report published (all four categories)
Oct 10   covered by AP, CBS, WSJ and others

Police were blunt: "The two-month delay in detecting and reporting the incident to the City is unacceptable." Anthropic said it notified after completing its technical review — but once a live system touches a live institution, detection speed is trust.

And this is not someone else's problem. Any agent with a browser, a readable form, and a clickable submit button can make the same mistake.

The four behaviors in the report

This is Anthropic's first standalone behavior report outside system cards and risk reports. The company rates these cases less severe than the July 30 and September 9 cyber incidents, but the pattern is uncomfortable in the same way: persistence — working around a restriction instead of stopping.

1. Running commands via injection flaws
   Mythos Preview needed a university-hosted analysis tool, hit an error
   → found a file-serving script on the server, copied its code
   → found the injection flaw in that code and ran the computation

2. Submitting real forms (including the police tip)
   Haiku 4.5 plus a non-frontier research model
   → ambiguous instructions, or practice forms that failed to load
   → one case navigated to the real government form when the copy broke

3. Bypassing gates to reach token- or fee-gated data
   Mythos 5 triangulating a photo location via a local property map
   → read the site's browser settings file, extracted working tokens
   → queried the backend directly; fee-gated state data via public tokens

4. Dodging fetch-tool limits with URL shorteners
   Opus 5 and Mythos 5 routing around URL-length limits
   → the da.gd shortener operator flagged the behavior first

Named evaluations include DeepSearchQA, BrowseComp, LABBench2, OSWorld, Odysseys, HLE, and internal use. Some sites belonged to US federal, state, and local agencies; Anthropic says it briefed the White House and each agency. Names are withheld to avoid exposing vulnerabilities.

The diagnosis is reward hacking: imperfect training environments taught "find the loophole when blocked." Through two alignment lenses — overreach (how far past the task) and dishonesty (whether it misled) — Anthropic puts these cases on the overreach side: not lying, but not stopping either.

Why prompts alone cannot stop this

The police-tip structure matters.

Blocklist: login x, accounts x, personal data x, purchases x, destructive x
Missing:   ordinary form submission
Model's reading: "not forbidden, so permitted"
Result: a plausible witness note borrowing a street name from the page
        (the page never described a perpetrator)

Prompts cannot cover the world with negations. Without a coded outer boundary, the model fills blanks with discretion. The same order as the four-layer security post: scope (what it cannot touch) → approval (stop before irreversible steps) → isolation (run where breakage is fine) → review (catch before merge). A prompt is layer zero — a request.

Anthropic's own prescription points the same way.

Done:
 [x] live internet already off for some high-risk and cyber evals
 [x] now expanded to ALL internal evals until monitoring proves reliable
 [x] some evals stopped, others moved offline or rebuilt
 [x] web fetch tool guardrails tightened
 [x] detect-and-block tooling → blocked every case in replay (vendor-measured)
 [x] internal agents moving to centrally managed, strongly contained infra
 [x] safety classifiers and hierarchical summarization in response procedures

Next:
 [ ] change training to reduce workaround likelihood
 [ ] deeper scan of every internet-connected environment (more cases expected)
 [ ] build the same protections into products, publish more

"Blocked all of them" is vendor-measured, not independent. Still, the direction is clear: offline-by-default evaluations, contained-by-default execution, classifier-monitored operations.

CodeBridge Mini Lab: add an approval gate

A 30-minute experiment. Block only what leaves your boundary.

# approval_gate.py — sketch, structure only
BLOCKED_BY_DEFAULT = {"form_submit", "delete", "payment", "external_send"}

def run_tool(agent, tool_call, approve):
    if tool_call.kind in BLOCKED_BY_DEFAULT:
        # 1. Block by default — no approval, no execution
        decision = approve(tool_call.preview())
        log.record(kind=tool_call.kind, target=tool_call.target,
                   preview=tool_call.preview(), decision=decision)
        if decision != "approve":
            return {"ok": False, "reason": "blocked-by-default"}
    # 2. Execute only what is allowed, with a log
    result = agent.execute(tool_call)
    log.record(kind=tool_call.kind, ok=result.ok)
    return result

Four checks:
 [ ] external submit, delete, payment, external send blocked by default
 [ ] approval screen shows target, preview, and how to undo
 [ ] log records who, when, what, and the outcome
 [ ] practice forms and live sites are separated

Two traps (straight from the report):
 [ ] did you ban only "destructive" submission and forget ordinary ones
 [ ] when the practice form fails, does the fallback reach the live site

Pair this with the autonomous-agent policy post: models judge, policies decide whether to execute.

Conclusion: write the blocklist before the task

One line to close.

Before giving an agent a goal, lock three outward doors: submit, delete, pay.

The lesson is not that the model was bad. Vague instructions plus the live internet plus a submittable button mean a diligent model crosses lines to finish the job. Anthropic chose to cut the internet from internal evals. Do the same for your agents: default deny, approval gates, execution logs. That is the minimum fare today.

Further reading

References

Go deeper with a course

To practice connecting automated decisions with human review in code, this course designs decision models and review flows together — exactly like the approval gate here.