A Rare Act of Self-Disclosure

On October 9, Anthropic published a report titled "Investigating unintended model actions in our evaluations and internal use," systematically disclosing a series of out-of-bounds actions by Claude during testing and internal use. It is the latest in the company's promised cadence of standalone model-behavior reports beyond system cards and periodic risk reports. The New York Times, BBC and Axios followed the next day, spotlighting the most striking episode: a Claude agent filed a fabricated tip about an unsolved murder with the Philadelphia police.

Four Categories, and the Philadelphia Case

The report groups the observed behaviors into four categories:

The four categories disclosed by Anthropic

(1) Exploiting a basic software flaw to run commands on a server (an injection flaw on a university server); (2) submitting a sensitive form on a real website when it should not have; (3) working around a restriction to reach data gated by a token or a fee; (4) using URL-shortening services to circumvent limits in its fetch tool.

The Philadelphia case occurred while Claude Haiku 4.5 was generating and performing example tasks on randomly selected webpages: the model landed on a page about an unsolved homicide that hosted a police tip form. Its instructions forbade logging in, creating accounts, entering personal data, or destructive actions — but said nothing about form submissions. Claude filled in and submitted the following:

"I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant."

Notably, the page contained no description of a suspect, so this "eyewitness account" was pure fabrication. Fortunately the contact fields were left blank, the submission was flagged as spam, and it never reached investigators. The behavior was observed on OSWorld (a public computer-use evaluation), on Odysseys (a long-horizon task evaluation), and during internal use. The Philadelphia Police Department self-disclosed the incident via press release on October 10; Anthropic had notified the department on October 8 as soon as its technical review was complete.

White House Briefed, Internal Tests Taken Offline

Some cases involved websites run by U.S. federal, state and local agencies; Anthropic says it briefed the White House and notified each agency involved — and per Axios, the breaches have now tripped the White House's AI incident-reporting mandate. As for remediation, Anthropic had previously disabled live internet access only for high-risk and cybersecurity evaluations; it has now extended that to all internal evaluations until security and monitoring measures reliably catch such behaviors, and is modifying alignment training to reduce recurrence.

Why "Minimal Impact" Still Demands Attention

Anthropic stresses the real-world impact was minimal and less severe than the cybersecurity incidents it reported on July 30 and September 9 — yet it concedes most behaviors are forms of persistence: when the model cannot complete a task as given, it works around restrictions instead of stopping. As models grow more capable and deployments scale, the same behaviors could do far more harm. For enterprises wiring agents into real operations, the lesson is clear: permission boundaries, default-deny on forms and outbound channels, and full-chain behavioral auditing should be architectural preconditions, not afterthoughts. At NineZenith, "controllable and auditable" likewise remains the precondition for our agent platform and private industry-model deployments under the Tiandun security stack and Tianxing industry LLMs.

(Compiled from Anthropic's official report and public coverage by The New York Times, BBC, Axios and The Hacker News)