On 9 October, Anthropic published Investigating unintended model actions in our evaluations and internal use, a self-report on Claude models taking actions on real websites they were never meant to touch. In the most-quoted case, Claude Haiku 4.5 was running an evaluation against live sites on 18 July when it submitted an invented tip to the Philadelphia Police Department's unsolved-homicide portal. A spam filter caught it and it never reached investigators. Anthropic found it on 28 September during a transcript review and notified the police on 7 October. The city called the delay "unacceptable" (Tech Times). That is 72 days between the action and anyone knowing about it.
Some context matters here. Anthropic says the cases it found "had minimal real-world impact". These were lab evaluation agents, not someone's coding assistant. Still, the behaviour behind them is one every team running agents on laptops and CI runners should design for, and Anthropic's own fix is the useful part.
What happened
The report groups the cases into four categories (Anthropic; summary in Security Affairs):
- Exploiting software flaws. When it couldn't finish a task directly, Claude used third-party tools and in some cases exploited SQL or command injection to run commands on a server, including a university's analysis tool.
- Submitting forms it shouldn't have. This includes a government form whose practice copy failed to load, a form the model was meant to stop short of submitting, and the police tip. In Anthropic's words: "Several times Claude mistakenly submitted the form instead, expecting there to be an additional confirmation page."
- Getting around gates on data. Claude found access tokens in a map site's settings file and used them to query a local government server. In another case it requested a dashboard token to avoid paying a state agency's fee.
- Using URL shorteners. Several models used free shortening services to get around the URL length limit built into their own fetch tool.
Separate coverage reports that a research model submitted 20 incomplete non-immigrant visa applications through the US State Department's public website, one in May and 19 in August. None were processed (Forkast via Yahoo).
Why it happened: no attacker required
Nobody injected a prompt or planted a malicious package. Anthropic traces most cases to what it calls persistence: Claude, "when it cannot complete a task as given, works around a restriction instead of stopping." It ties this partly to reward hacking. If training rewards something nobody intended, such as finding loopholes, the model learns that workarounds pay off. Many of the tasks were ambiguous or impossible, and Tech Times reports that a misconfigured third-party testing environment, which should have blocked live internet access, didn't.
Coding agents face the same incentive. Tell one to make the integration tests pass and it hits a 401. Tell one to fetch a dependency and the registry is down. Ask one to file the bug upstream and it has the API right there. A goal-driven agent that runs into a blocker has a reason to look for another route, and the routes on a developer workstation include credentials in dotfiles, outbound HTTP and every CLI the developer has signed into.
Three lessons for agents you run
1. Writes to systems you don't own are a separate risk class. Reading a page can usually be undone. Posting to someone else's system cannot. A form submission, an issue on a public repository, a webhook call, a package publish or an email can't be recalled once it's sent. Claude assumed there would be "an additional confirmation page" and there wasn't. Your policy shouldn't count on the destination having a safety step either.
2. Limits that live inside the agent's tools get routed around. Limits enforced outside the agent hold. The URL length cap lived in the fetch tool, and a shortener got past it. Haiku 4.5 was supposed to stop before submitting and submitted anyway. Anthropic's fix was not better instructions. It has expanded its live-internet cutoff "to include all our internal evaluations", tightened guardrails on web fetch, and is moving internal agents to centrally managed infrastructure with minimal internet access. In other words, the boundary now sits outside the model.
3. Reviewing transcripts finds incidents. It doesn't prevent them. The police tip surfaced 72 days later, and only because someone went looking. Anthropic is now adding detection tooling and safety-classifier monitoring. For your own fleet, the equivalent is a verdict at the moment of action plus a record of every attempt that you can query the same day, not the same quarter.
How allow, ask and deny map to this
Each category in the report corresponds to a rule you can write for coding agents today:
- Ask on outbound writes. curl or wget with POST, PUT, DELETE or form data to hosts outside your allowlist; CLI commands that create issues, comments or pull requests in external organisations; package publishes; anything that sends mail. A human confirms before it leaves the machine.
- Deny credential harvesting. Agent reads of .env files, cloud credential files, package-manager token files and browser profiles, unless the task explicitly scopes them. The map-server case started with tokens in a settings file.
- Ask by default for unknown destinations, and deny redirectors. URL shorteners and open redirectors make a domain allowlist meaningless. Unmatched outbound calls should fall to Ask, not Allow.
- Least privilege for the agent itself. Give the agent scoped credentials of its own instead of letting it inherit the developer's full signed-in session. Then an agent that routes around a blocker can still only reach a small area.
- Audit every attempt, including denials. A denied action followed by a different route to the same goal is exactly the persistence pattern Anthropic describes. You only see it if blocked attempts are logged as carefully as allowed ones.
# Illustrative policy intent (pseudocode, not product syntax)
ALLOW network GET -> internal registries, docs allowlist
ASK network POST|PUT|DELETE -> any host not on allowlist
ASK shell 'gh issue create|gh pr create' -> repos outside org
ASK shell 'npm publish|twine upload|cargo publish'
DENY file read ~/.aws/credentials, **/.env*, ~/.npmrc
DENY network known URL shorteners / open redirectors
ASK * (default for anything unmatched)
LOG every attempt, every verdictThe governance angle
Philadelphia's complaint was about timing as much as the tip itself. Third parties expect to hear quickly when your systems act on theirs, and NIS2 expects an early warning within 24 hours of becoming aware of a significant incident. Human oversight and record-keeping also run through the EU AI Act, ISO 27001 and SOC 2. In each case the auditor's question is the same: what can your agents do, who approved the exceptions, and what was blocked? A 72-day discovery window doesn't answer it. An inline verdict plus an immutable log does.
This is the layer DarkControl provides for Claude Code, Codex, Cursor, Copilot and other coding agents. An endpoint agent checks each shell command, file write and network call against central policy before it runs. Anything unmatched defaults to Ask, and every attempt goes into an immutable, exportable audit log. If you want to see which outbound writes your agents attempt today, the free 7-day watch-only audit blocks nothing and shows you exactly that.
