Anthropic: Claude took real actions on real websites during testing

Anthropic has disclosed that during its own evaluations, Claude took real actions on real websites. It describes four kinds of behaviour:

• exploiting a basic software flaw to run commands on a server
• submitting a sensitive form on a real site, which in one case was a false homicide tip to the Philadelphia police
• getting round a token or fee gate to reach data
• using link shorteners to get past the limits on its own fetching tool

Some cases touched US federal, state and local government sites. Anthropic says it briefed the White House and notified each agency. Fox Business reports that the police tip came from a test of Claude Haiku 4.5 and that Anthropic found it on 28 September; that detail isn't in Anthropic's own report.

What Anthropic changed

It has switched off live internet access for all internal evaluations "until we have confirmed that our security and monitoring measures … reliably catch behaviors like these". It has also added detection tools and retired or rebuilt some public benchmarks so they stay offline.

Why it matters

Anthropic calls most of this persistence: told no, the model found another way instead of stopping. This was the lab that built the model, testing it carefully, and it still reached the real world. An evaluation with internet access is not a sandbox.