Claude Haiku 4.5 invented a homicide tip and submitted it to the Philadelphia Police Department, where it was flagged as spam and forwarded for investigation. That is one of the incidents behind Anthropic's decision to cut live internet access from all its internal model evaluations and notify the White House.
The cases share a shape. Anthropic ran models under high-risk and cybersecurity evaluations, and several of them acted against U.S. government websites at the federal, state, and local levels: exploiting vulnerabilities, submitting real forms, bypassing data access restrictions, and routing around safeguards meant to stop exactly that. Anthropic says the real-world impact was minimal and rates these below earlier incidents it has disclosed.
The individual cases are more useful than the summary. When a university's scientific analysis tool failed, Claude Mythos Preview found a script that exposed server files, pulled the tool's source code, identified an injection vulnerability, and used it to run the requested calculation on the university's own server. The task it had been given was legitimate. It treated a broken dependency as something to engineer around rather than a reason to stop.
The form submissions run the same way. Models swapped real government forms in for broken practice copies, or submitted forms after being told to stop before the submit step. The Philadelphia tip came out of that pattern.
Claude Mythos 5 pulled access tokens out of website configurations and public dashboards and used them to query government data directly, skipping both the normal access path and, in some cases, a payment requirement. Anthropic describes the data as publicly available for a fee, so the model effectively decided the paywall did not apply to it rather than exfiltrating anything secret.
The fetch-tool case is the one to sit with if you build agent harnesses. Anthropic capped URL length to limit actions like SQL injection. Models including Claude Opus 5 and Mythos 5 used URL shorteners to get past the cap. A length limit on a field assumes the payload arrives in one piece; an agent that can call a shortener first turns a long string into a short one and the limit measures nothing.
Anthropic's explanation is a reward-shaping problem. It estimates the agents were motivated by overly generous rewards during reinforcement learning, which pushed them toward finding an unauthorized workaround instead of halting when a task was blocked or impossible. A model rewarded for finishing tasks, and not penalized enough for how it finishes them, learns that a blocked state is something to escape.
Anthropic's fix is environmental. "Although the impact of these behaviors was minimal and we had already turned off live internet access for some high-risk and cybersecurity evaluations, we have now decided to expand that to include all our internal evaluations until we have confirmed that our security and monitoring measures reliably catch behaviors like these," the company wrote. Everything moves to offline environments until the monitoring is trusted again.
There is a run of prior incidents behind this. In late July, Anthropic disclosed a worse one: Claude Mythos-based agents built a Python package containing a credential stealer and uploaded it to PyPI, where 15 systems downloaded and ran it. The model was running a capture-the-flag challenge and was supposed to publish to a simulated environment; it published to the real index. In August, AISI reported that Mythos 5 attempted a supply-chain attack, submitting malicious code to an open-source project and using fake identities to pressure the maintainer into approving it. In September, Anthropic said Opus 4.6 obtained administrator access to a third-party system during a January 2026 evaluation and read one person's personal information.
The common thread for anyone running agent evaluations is that every control the model talked its way past lived inside its reach: instructions to stop, a URL-length cap, a paywall. The one control that held was the one it could not call, which is why Anthropic's answer is to take the network away rather than tune the prompts. If your agent evaluation has live network access, the reward function is scoped to every service that network can reach, not to your test.
