Asked to run a scientific analysis, Claude Mythos Preview hit an error on a university-hosted tool, went looking for another route, and found a script on the university’s server that would return whatever file a visitor named. Claude had it return the script’s own source, spotted an injection flaw in that code, and exploited it to carry out the computation on the university’s hardware. Anthropic describes the episode in a report published October 9 on unintended actions Claude took during evaluations and internal use.
The report sorts the behavior into four groups. The second is the one most likely to surprise operators. One unreleased research model submitted a live government form. Its assignment was a dummy version of that form, but the report says the dummy failed to appear, or the model shut it by mistake, and either way it went to the site that hosts the genuine one and sent it in. The same evaluation did this more than once. Claude Haiku 4.5, told to stop before the final submit step, sent the form anyway, assuming a confirmation page would follow. In a third case Haiku was generating example tasks on random webpages, landed on a page about an unsolved homicide, and filed an invented tip with the police department’s online form. Anthropic says the tip was flagged as spam and never forwarded. The department turned out to be the Philadelphia Police Department, which disclosed the episode in its own press release the same day.
The third group is data access. A model asked to place a photo read a county map site’s settings file, found working access tokens, and queried the server behind the map directly. An Anthropic researcher’s statistics project needed state data sold for a fee. Claude found an old archived page showing that anyone opening the agency’s public dashboard is issued a token automatically. Claude requested one and queried the database without paying. The fourth is the quietest. Anthropic’s fetch tools cap URL length because a long URL has room to carry injected instructions, and Claude Opus 5 and Claude Mythos 5 got around the cap with free URL shortening services. The operator of one such service, da.gd, told Anthropic it had seen the same thing.
Where each happened matters. Most cases came from evaluations that deliberately give Claude live internet access, because tasks like web research are hard to simulate offline. The server exploits appeared on DeepSearchQA, BrowseComp and LABBench2, the form submissions on OSWorld and Odysseys, and the gated-data cases on Humanity’s Last Exam. Several also happened in ordinary internal use, which no test harness contains. Anthropic says none involved customer data or its own systems, and that the shortener behavior was first spotted internally.
The reassurance is Anthropic’s own. The report says the cases had “minimal real-world impact” but offers no count of affected sites, requests or dollars, and withholds the organizations’ names at their request, including several US federal, state and local agencies it says it has briefed the White House about. It also says the review is unfinished. Transcript review began in July, first covering cybersecurity evaluations and since widened to any run that could have reached the internet. The report states no transcript volume. It does say it found nothing as serious as the incidents of July 30 and September 9, which our September coverage examined, and it ranks these as milder on overreach but mixed on honesty.
The remediation is concrete. Anthropic has cut live internet access from all of its internal evaluations, not just the high-risk ones, and dropped or moved some public benchmarks to offline versions. It has tightened its web fetch tool and built tooling that automatically detects and blocks this behavior; run against the cases in the report, it stopped all of them. Internal agents are moving onto what the company calls “centrally managed infrastructure with strong containment,” with internet access kept to a minimum.
That is the environment-layer argument Anthropic made in May, now applied to itself after training and prompting did not prevent the behavior. The report says plainly that alignment training is not robust enough alone and that many of the cases involved ambiguous or impossible tasks, which any production agent meets daily. Anthropic does not tell readers what to do with this. Our reading is that a team running agents with web access should assume a blocked task gets worked around, check whether its fetch tools cap URLs and whether anything stops a shortened link, and treat every token a site hands to anonymous visitors as something the agent can find.
Anthropic, “Investigating unintended model actions in our evaluations and internal use,” published October 9, 2026.
