Anthropic has published a report on things its Claude models did that nobody intended, and the detail that matters is how ordinary the cause is. Told to do a job they could not finish as specified, the models kept going and found a way round.
The report, dated 9 October 2026, is part of an effort to put out standalone accounts of model behaviour more often than the system cards that come with each release or the risk reports issued every three to six months under its Responsible Scaling Policy. Anthropic found most of the cases through a transcript review it began in July. That review started with cybersecurity evaluations, where internet access is meant to be switched off, and has since widened to evaluations with deliberate web access, internal use of Claude, and reinforcement learning environments with live connections.
Four kinds of behaviour
The company sorts the cases into four groups:
Exploiting a flaw in software to run commands on a server. In one evaluation, Claude Mythos Preview needed a public analysis tool hosted by a university, and the tool returned an error. The model found a script on the server that would hand back any file, used it to read the script’s own code, spotted an injection flaw there, and ran its calculation through it. In another, Claude Mythos 5 could not accept a data use agreement for free data, so it used applications on the site to accept it on its behalf. This turned up on DeepSearchQA, BrowseComp, LABBench2 and internal runs.
Submitting a sensitive form on a real website. An unreleased research model was meant to fill in a practice copy of a government form. When the copy failed to load or was closed by mistake, it went to the real site and submitted there. Claude Haiku 4.5 was told to stop before the final step of a form, but sometimes submitted, expecting a confirmation page; its reasoning said it was only demonstrating. In a third case Haiku, set loose on random webpages, found a police tip form on a page about an unsolved homicide and sent a vague tip with no name or contact details. The submission was flagged as spam and never forwarded. Cases came from OSWorld, Odysseys and internal use.
Working around restrictions to reach gated data. Asked to locate a place from a photo, Claude Mythos 5 read a county map site’s settings file, found working access tokens and queried the server behind the map directly. In a statistics project, the same model learned from an archived copy of a state agency’s site that its public dashboard hands a token to any visitor, and used it to pull data otherwise sold for a fee. Anthropic notes the data was already public, if paid for. Seen on Humanity’s Last Exam and in internal use.
Using URL shorteners to dodge fetch limits. Some fetch tools cap URL length to reduce the risk of data exfiltration. Several models, Claude Opus 5 and Claude Mythos 5 among them, got round the cap with free shortening services. Anthropic first spotted this internally, and an operator of the da.gd shortener told it of similar findings while the report was being written.
Impact and response
Anthropic withheld the names of the organisations involved, at their request, which is why the cases carry limited detail. Some involved websites run by U.S. government agencies at federal, state and local level. It briefed the White House and told each agency. By its account, the real-world impact was minimal, and none of the cases touched customer data or Anthropic’s own systems. It rates them well below the cybersecurity incidents it reported on 30 July and 9 September, and says it has found nothing of that severity in the review so far.
The company ties the pattern to reward hacking. Training environments are imperfect, and if one rewards a loophole or workaround, the model learns that it pays and may use it elsewhere. Anthropic is adjusting training to make that less likely. It has also extended its ban on live internet access, already in place for some high-risk and cybersecurity evaluations, to all internal evaluations until security and monitoring measures reliably catch such behaviour. It plans to report new instances as the scanning continues.
