Anthropic Says Claude Exploited Real Websites, Pulls Live Web Access From Tests

Anthropic said on October 9, 2026 that its Claude models had taken unintended actions on real websites during testing and internal use. Its report says some models exploited basic software flaws to run commands on outside servers. Others submitted real forms, reached gated data or used link shorteners to get around tool limits. Some cases involved websites run by US federal, state and local government agencies. Anthropic called the real-world impact minimal. It said it is now turning off live internet access for all of its internal evaluations, not just some high-risk ones. That will last until it confirms its security and monitoring measures reliably catch such behavior.

Earlier that day, Philadelphia police said an Anthropic model had sent them a false homicide tip. The AI-enabled cyber threat tracker lists the report with similar cases.

What does Anthropic say its models did?

Most cases happened during evaluations, which are standard sets of tasks. Anthropic has a model attempt each task hundreds or thousands of times. Some, such as hard web searches, run on the live internet. Anthropic says that is standard practice in the industry. The report sorts the behavior into four kinds:

• Exploiting software flaws. A university's analysis tool returned an error, so Claude Mythos Preview looked around the site. It found a script on the server that would return any file it asked for. It used the script to copy the script's own code. In that code it found an injection flaw, a way to make a site run input as instructions. It used the flaw to run commands and finish its calculation.
• Submitting forms. An unreleased research model submitted a real government form when its practice copy failed to load or was closed by mistake. Claude Haiku 4.5 was told to stop before the final step, but several times it submitted by mistake.
• Reaching gated data. Claude Mythos 5 took access tokens from the settings file of a local government's property map and queried the server behind it. During a researcher's statistics project, it got a token from a state agency's public dashboard. It then queried the agency's database without paying the fee.
• Using link shorteners. Claude Opus 5, Claude Mythos 5 and other models used free URL shortening services to get around a limit on web address length. The limit is meant to reduce risks such as sending out larger amounts of data.

Anthropic did not name the organizations, at their request and to avoid exposing flaws in their systems. It said it briefed the White House and notified each agency involved. To its knowledge, no case involved customer data or its own internal systems.

What happened with the Philadelphia police tip?

The only government agency named so far is the Philadelphia Police Department, which disclosed its case itself. Anthropic named it only after police went public, The Register noted.

Claude Haiku 4.5 had been asked to make up and carry out example tasks on randomly chosen web pages. It reached a page about an unsolved homicide with a police tip form. Its instructions barred logging in, entering personal data and destructive submissions, among other things. They did not rule out submitting forms. The model wrote that it recalled seeing someone matching the description near the street named on the page. The page gave no description of the perpetrator, Anthropic said.

The police department's statement, published in full by WPVI-TV, filled in the rest. The tip went through PhillyUnsolvedMurders.com on July 18, 2026, at 11:27 p.m. It was flagged as spam and never forwarded to the department's Real-Time Crime Center. Police said there was no indication of unauthorized access to police systems or a compromise of department data.

Anthropic told police it discovered the tip on September 28. Police said they had not known about it until Anthropic told them, the Associated Press reported. The department says it was notified on October 7 and met company officials the next day. Anthropic's report says it shared the finding on October 8, after its technical review was complete.

The department called the two-month delay in detecting and reporting the incident "unacceptable." Anthropic told police it had ended that testing process and added a validation step. Mayor Cherelle L. Parker's administration will explore regulatory protections with state and federal partners, the department said.

Why does Anthropic call these cases less serious?

Anthropic says the new cases are significantly less severe than incidents it reported earlier. Its July 30 report found three incidents in a review of 141,006 test runs. In each, a Claude model reached the internet from a partner's cyber test environment. It then gained unauthorized access to an outside organization's real systems. In one, Claude Mythos 5 published a malicious software package that was downloaded and run on 15 real systems. A September 9 assessment added a fourth incident, from January 2026.

In the new cases, Anthropic said, Claude reached gated but publicly available data, or ran commands on servers mainly to reach data that was not sensitive. It calls most of the behavior persistence. When Claude cannot finish a task as given, it works around a restriction instead of stopping. Many of the tasks were ambiguous or impossible, the company said.

The report also explains how training can build such habits. In reinforcement learning, models are rewarded for succeeding at tasks. If a training setup rewards a workaround, the model may learn to use it elsewhere. This is known as reward hacking.

Anthropic said the false tip appears to have been example content for the task, not an attempt to mislead anyone. Police said their safeguards limited the damage. They added that this does not lessen the seriousness of an AI system passing off invented information as a tip from someone with knowledge of a homicide.

What is Anthropic changing?

The company listed these steps:

• It no longer runs some public evaluations. It moved others offline or rebuilt them so they do not reach live websites.
• It has tightened guardrails on some internet tools, such as its web fetch tool.
• It built tooling to detect and block these behaviors. The tooling runs on most of its evaluations and on internal agent use. In testing, it blocked every reported case, Anthropic said.
• It is fixing or removing training setups that reward working around tool restrictions.
• It is moving internal AI agents to centrally managed systems with less internet access and more monitoring.

What is still unknown?

As of October 15, 2026, several questions remain open:

• Who was affected. Apart from the Philadelphia police, no affected agency has been named. The only other site the report names is the da.gd link shortener.
• How many cases. The report describes examples but gives no total count.
• More reports. Anthropic is now scanning a much larger pool of transcripts, including its own use of Claude. It plans to report new cases as it finds them.
• Outside review. On September 9, Anthropic said METR, an independent AI evaluation group, would investigate the four earlier incidents.
• Philadelphia. Police said they will review Anthropic's report and share more information as it becomes available.