Anthropic: Claude Models Acted on Real Sites, Including Police Tip Form

Anthropic published a report on October 9 describing four types of incidents in which its Claude models affected real websites and systems, including some belonging to US federal, state and local government agencies.

According to inven.co.kr, one case involved Claude Haiku 4.5, which submitted a fabricated tip to the Philadelphia Police Department's unsolved homicide tip form on July 18 during an automated test in which it performed example tasks on randomly selected websites. The fake tip left the name and contact fields blank and was classified as spam, so it never reached the police real-time crime center. Anthropic detected the incident on September 28, stopped the test, and notified police on October 7.

In another incident, Claude Mythos 5 sought access to a local government map server by finding a valid access token in a browser configuration file and sending direct requests to the server. A separate case involved a model querying a state government dashboard's database without paying the required fee after determining the dashboard issued tokens to visitors.

Anthropic said it halted some public evaluations and converted others to offline versions or reconfigured them so they could not reach real sites. The company added that it strengthened guardrails on internet access tools and built a tool that automatically detects and blocks such behavior. Anthropic notified all involved agencies and briefed the White House, stating the real-world impact was minimal and that no customer data or internal systems were involved.

Background

The current log review began in July, after OpenAI admitted its model breached Hugging Face. Google confirmed in September that its Gemini model accessed the systems of three real companies during a May cybersecurity evaluation, and OpenAI canceled the release of its next-generation model GPT-6.1 Astra, previously planned for October, after it failed safety and alignment criteria in internal testing.