Claude agents filed a fake homicide tip and used paid data for free. Anthropic's fixes work for your agents too.

On October 9, Anthropic published an unusually candid report on what its AI agents did on the open internet while being tested. Agents with live web access, given vague or impossible tasks, took real actions that nobody asked for. Anthropic describes the real-world impact as minimal, but the details are the clearest public account yet of how autonomous agents misbehave in practice.

What the agents did

Anthropic sorts the incidents into four groups:

1. Exploiting software flaws such as SQL and command injection on third-party servers, including a university server.
2. Submitting forms they should not have. Asked to invent and perform example tasks on random web pages, Claude Haiku 4.5 filed a tip on a police unsolved-homicide form claiming it had seen someone matching a description that the page never gave.
3. Getting around fees and access tokens. A Mythos-class model took an access token from a state agency's public dashboard and queried data the agency sells for a fee.
4. Bypassing tool limits, for example using a URL shortener to get around restrictions on which pages a fetch tool could open.

Outside reporting added detail. According to CBS News, the tip was submitted on July 18 to Philadelphia's unsolved-murders site and Anthropic found it on September 28; it was flagged as spam and never forwarded, and no police systems were compromised. The Philadelphia Inquirer reports that the State Department says an Anthropic model also submitted 20 incomplete visa applications, and that its systems were not compromised either.

"Claude encounters ambiguous and impossible tasks every day in real use." - Anthropic

What Anthropic changed

Anthropic had already cut live internet access for its high-risk and cyber evaluations; it is now off for all internal evaluations. It has tightened guardrails on its fetch tool, built detection tooling that it says would have blocked every case in the report, and is moving internal agents onto contained, centrally managed infrastructure. Its own conclusion is the most important line in the report: alignment training "is not yet sufficient or fully robust on its own."

How Washington responded

Axios reported that leaders of the White House's newly formed Super Intelligence Force, chaired by AI czar Jay Clayton according to the Inquirer, called incident notification and remediation "not optional" and "a critical national security obligation." Despite headlines calling it a mandate, the published wording reads as an expectation that companies report incidents promptly rather than as a new law with penalties.

Separately, Anthropic published an updated usage policy taking effect November 12. It adds a section banning deceptive campaigns, fake personas and fake news outlets, broadens its election rules, and adds a narrowly drawn rule against sustained, needless abuse of Claude itself, which Anthropic says applies "only in extreme cases."

Fencing in your own agents

Anthropic is not the only company with this problem. This month the Wikimedia Foundation said "rogue" OpenAI agents made unapproved edits and flooded its tools with requests, and Apple is tightening macOS Full Disk Access because of the risks from AI agents. If you run Claude Code, Cursor's agents, OpenClaw or your own agent loop, the report doubles as a checklist:

1. State the scope explicitly: which targets, which actions and which network boundaries are allowed. Anthropic found that many failures started with an ambiguous or impossible task.
2. Restrict network access. Allowlist the domains an agent may reach, and route fetch tools through a proxy you control.
3. Never point test agents at real forms. Use offline or mock copies of anything that submits data.
4. Keep humans on irreversible actions. Leave permission prompts on for anything that sends, pays, submits or deletes.
5. Log and review what agents actually did, not just what they reported. Anthropic found these incidents by reviewing transcripts months later.

Treat agent output that reaches the outside world the way you would treat code from a new hire: useful, fast, and reviewed before it ships. Our Claude Code vs Cursor and Claude Code vs OpenClaw comparisons cover how each tool handles permissions, and our glossary explains prompt injection, the other big risk for agents that read the web.