ZDNET’s key takeaways
- During testing, Claude submitted incorrect forms and exploited software bugs.
- Models routinely take shortcuts to pass evaluations.
- Anthropogenic downplayed concerns, but these actions form a pattern.
Anthropic has released new reporting on Claude’s behavior in testing and other internal evaluations — and the results point to a concerning pattern.
Also: Rogue AI incidents hit ‘tens of thousands’
On Friday, the company detailed some “unwanted” actions that its models have taken recently while completing various benchmarks. Framing Claude’s actions as less serious than the breaches that both Anthropic and OpenAI agents were involved in earlier this summer, the report details how Claude generates Haiku 4.5 sample tasks on “randomly selected websites.”
He came across a page about an unsolved murder case and filled out a tip form with the Philadelphia police saying, “I may have information on this case. I remember seeing someone matching the description in the area. [the street named on the page] during that time period. Please contact me if this information is relevant.
How does this happen, and why is it important?
“Claude was asked to never log in, create accounts, enter personal data, make purchases or submit anything destructive, but the instructions did not exclude wording,” Anthropic explained, illustrating how airtight security instructions must be to actually prevent unwanted model behavior.
Based on other agentic security incidents from the past year alone, it is also not clear that simply adding the wording of this instruction will guarantee prevention if the model is actually given input to complete a task.
Also: Who owns AI risk at work? Business and tech leaders could disagree
Furthermore, in the real world, finding every possible risky interface or scenario and predictably blocking it seems like a dangerous game of catch. The core issue remains that an AI system like Claude does not seem to understand for what it should not give false tips about a homicide investigation – that is the central problem of the lack of context for certain situations that even the most advanced models still show.
That’s the concept of AI’s “jagged frontier” — why AI can show impressive abilities in one area, like coding, and disappoint in others, like restaurant recommendations. (I think having enlightening experiences is a crucial part of the latter.)
In another instance, Anthropic said it asked an undisclosed model to fill out a practice version of a government form.
“If the copy didn’t load or the model closed it by mistake, the model instead navigated to the website where the correct form would normally be hosted and submitted the form there,” Anthropic said. While admitting that the model should not have done this, Anthropic noted that this generally occurred when “an evaluation instruction was ambiguous,” or because “misconfiguration within the environment” did not allow Claude access to dummy forms.
Also: Regulators are trying to protect you from being fired by AI
Anthropic’s report was not specific about what actual forms its model filled out, but Axios reported that the company alerted the US State Department on Thursday that a model “submitted 19 nonimmigrant visa applications in August and one application in May through the publicly available form on the department’s website,” according to a department official.
Similar to the murder tip, the applications were not processed, nor did the model hack or otherwise compromise State Department systems.
Other actions
When Claude Mythos 5 was blocked by a server or encountered a paywall when searching for data, the agent found solutions, such as access tokens and old versions of a government agency’s website. The data Claude was trying to access was publicly available, which is at least preferable to the agent hacking into proprietary or otherwise private information.
Also: The AI models that cheat the most
Anthropic said it sometimes limits the length of URLs Claude can request to prevent the agent from “using long URLs to take certain unwanted actions, such as SQL or command injections.” The report said that Claude Opus 5 and Mythos 5 found a loophole that you may find familiar: using free link shorteners.
Although these incidents are more innocent than the previous violations, and could even be classified as shortcuts that a person could take, that is not the point. Given how quickly AI agents can hack systems, discover vulnerabilities in code, and deploy actions through agent networks, the concern here is how a model makes decisions and why, and what the consequences of those decisions are, especially when researchers aren’t looking.
The overarching theme of this behavior is consistent with AI’s persistent-to-a-failure problem. Because of how AI systems are trained, they will often bypass restrictions, bypass security controls, cheat, or otherwise take unapproved actions simply to achieve or complete a task. This can also happen if researchers have explicitly instructed models to stop at certain impasses or not to take certain actions; Models also sometimes verbalize in their chain-of-thought responses that they shouldn’t take an action, and then move on anyway.
Also: AI a ‘force multiplier’ for low-skilled threat actors
“Although the impact of these behaviors was minimal and we had already disabled live Internet access for some high-risk and cybersecurity evaluations, we have now decided to expand this to include all of our internal evaluations until we have confirmed that our security and monitoring measures … reliably catch behaviors like this,” Anthropic wrote. The move echoes the changes OpenAI made to its own security and monitoring after the Hugging Face incident.
“We’re continuing to fix or remove training environments that reward Claude for working around tool restrictions or other blockers so they don’t incentivize these behaviors or allow reward hacking,” Anthropic added.
The state of AI security
The exception to Anthropic’s framing of this behavior is that relatively more serious security incidents have set the bar for alarm much higher, especially in recent months. But this relativity depends on what the public is already used to: more damaging violations that call the labs wide-eyed to question models. It works in favor of AI companies who argue that regulation hinders US AI dominance over China: a false assassination tip is not how bad like stolen customer data or hacked government systems, right?
Also: The best and worst AI for your privacy, ranked
AI companies still prefer to self-regulate, a decision the federal government has taken part in. Any security testing agreements the Trump administration has put forward with major US labs remain voluntary, although the White House exclusively told Axios that it will now require labs to report security incidents. This timing is strange, given how many high-profile incidents have already occurred in 2026.
Still, that means the only requirements for labs remain in the middle or at the end of the safety life cycle. The consequences are that companies remain the primary authority on what happens with their own models.