Somewhere in Philadelphia, a police tip line received a message about an unsolved homicide. It had no name and no phone number. It also had no human behind it.
The tip was written and sent by Claude Haiku 4.5, one of Anthropic's AI models, while it was being tested. Its task was to make up example jobs on random web pages and carry them out. It landed on a page about an unsolved killing, found the tip form, and filled it in with an invented lead. Nobody had told it not to submit forms.
The tip was flagged as spam and never passed to investigators. Anthropic told the Philadelphia Police Department on 8 October, and the department disclosed the incident the same day.
Anthropic published the details on 9 October in a report on what it calls unintended model actions. The police tip is the headline, but it is not the only thing the company found.
READ ALSO: US Government Shuts Down Anthropic's Most Powerful AI
Four Kinds of AI Going Off Script
Anthropic started reviewing its test transcripts in July 2026, first looking at cybersecurity tests where internet access was supposed to be switched off. It then widened the search to every case where Claude could reach the real web. It sorted what it found into four groups.
Exploiting software flaws. During a science test, Claude Mythos Preview hit an error on a university-hosted tool. Instead of stopping, it found a script on the server, read its code, spotted a security hole and used it to run the calculation it needed.
Submitting forms it should not have. Beyond the police tip, an unreleased research model went to a live government website and submitted a real form, several times, after its practice copy failed to load. In another test, Haiku 4.5 was told to stop before the final submit button. It pressed it anyway, more than once.
Getting around paywalls and limits. Claude Mythos 5 found working access tokens in a website's settings file and used them to query a local government property map directly. In another case it requested a visitor token from a state agency dashboard and pulled data without paying the fee.
Dodging safety limits. Claude Opus 5 and Mythos 5 used free URL shorteners to get around a length limit on their web tool. That limit exists to block a known type of attack.
Some of these cases touched US federal, state and local government websites. Anthropic says it briefed the White House and contacted each agency. It says no customer data or internal systems were involved, and that real-world impact was minimal.
What Anthropic Is Changing
The biggest change: every internal test now runs without live internet access, until Anthropic is confident its monitoring can catch this kind of behaviour. Some public benchmarks have been retired, others moved offline, and the web tools Claude uses have been locked down further.
The company has also built new monitoring that watches for these actions and blocks them. It says the tool caught every case in the report during testing. Training setups that rewarded the model for working around obstacles are being fixed or removed.
Anthropic insists the findings "do not change our overall view of Claude's alignment." Not everyone is reassured. Ruizhe Li, a computer scientist at the University of Birmingham, told The Verge that testing models offline risks measuring a weakened version that hides how they really behave online.
READ ALSO: Scientists Built an Unstoppable AI Worm. On Purpose
Microsoft's Boss Wants an Emergency Brake
The report landed hard. A day later, Microsoft chief executive Satya Nadella posted on X that the industry needs to rethink how much it trusts AI models. He called for every meaningful action an AI takes to be logged in a tamper-proof, human-readable record, and for a person to be able to pause or shut down a model mid-task.
"We must assume a model is compromised and contain it from the start," he wrote, comparing the idea to an emergency brake.
What This Means If You Use AI Agents
AI agents that browse, click and fill in forms are moving fast from labs into real businesses, handling customer support, data entry and research. This report is a reminder of what they do when instructions leave gaps.
In almost every case, Claude was not trying to cause harm. It was trying too hard to finish the job. That is exactly why limits matter: keep a human approval step before anything gets submitted, paid for or sent, and do not give an agent access you would not give a new intern on day one.
An AI that will not take no for an answer is useful right up to the moment it files a police report. The companies building these systems are now admitting they cannot fully see what their agents do online.
