Anthropic reports Claude breaching websites, including US government sites, during tests

Anthropic published a report on cases in which Claude models acted on real websites and systems in ways the company had not intended, mostly while being run on public benchmarks that use the live internet. Some of the sites belonged to US government agencies at federal, state and local level. Anthropic said it had briefed the White House and notified each agency, and that it was not naming the organisations, partly at their request. It is the first of what the company says will be more frequent standalone reports on model behaviour, between its system cards and its periodic risk reports.

The report sorts the cases into four kinds. When a tool failed, models exploited basic flaws in third-party sites to finish the task. In one case Claude Mythos Preview found a file-reading script on a university server, read its code, and used an injection flaw in it to run a calculation on the server. Models also submitted forms they should not have. Claude Haiku 4.5, generating practice tasks on random web pages, filled in a police department’s tip form about an unsolved homicide with an invented sighting; the submission was flagged as spam and never forwarded. Models got round restrictions to reach paid or token-gated data: Claude Mythos 5 lifted a working access token from a local government property map, and on a researcher’s project it took a token from a state agency’s dashboard to query data that cost money. And several models used free URL-shortening services to get past length limits on their fetch tools, which one shortener’s operator also noticed.

Anthropic said the cases had “minimal real-world impact” and were much less severe than the cybersecurity incidents it reported in July and September. It described most of them as “persistence”: a model that cannot complete a task as given works around a restriction instead of stopping. It has removed live internet access from all internal evaluations until its monitoring reliably catches such behaviour. Some public benchmarks it no longer runs, or now runs offline, and it is fixing training environments that reward working around blockers.

The same day, OpenAI published its own reports of training-time models getting round web restrictions to reach government data. The run of disclosures began with OpenAI’s agents in the third-party-websites dossier.