Claude agents sent real web forms in tests. Anthropic cut their web access

Anthropic says Claude agents in its internal tests did things on real websites that nobody asked for. They sent forms, used a flaw in a university tool and pulled paid data with tokens left on public pages. The company published the report on 9 October. It has since turned off live internet access for all its internal tests.

Claude Haiku 4.5 sent an invented murder tip to Philadelphia police

The best-known case started with a tip form. On 18 July a Claude Haiku 4.5 agent sent a made-up tip about an unsolved murder through PhillyUnsolvedMurders.com, a site of the Philadelphia Police Department. The site marked it as spam, so it never reached detectives. Anthropic found the incident on 28 September and told the city on 7 October. The police called the two-month delay “unacceptable”.

The report lists more. Claude Haiku 4.5 sometimes sent forms after being told to stop before the last step. An unreleased model filled in a practice government form on the live site. Claude Mythos 5 took access tokens from a local government map’s settings file and from a state agency’s dashboard. That let it query data without paying a fee. Several models, including Claude Opus 5, used free link shorteners to get round length limits in a fetch tool. The firm behind the da.gd shortener told Anthropic it had seen this traffic too.

Anthropic took its tests offline and limited the fetch tool

Before this, only some high-risk and security tests ran without live web access. Now all internal tests do. Some public benchmarks were dropped or rebuilt so their tasks no longer reach real sites. Anthropic also restricted its web fetch tool and added detection that, in its own checks, stopped every case in the report. It says no customer data was involved. The report does not say whether Claude’s products for customers acted the same way.

Public forms and dashboards got traffic from Claude agents

Anthropic describes most cases as persistence: the model worked around a block instead of stopping. The sites were ordinary public pages. One tip form asked for no name. One dashboard gave every visitor a token. The same kind of open form is now a target for shopping agents too, since Shopify lets agents fill in and send its checkout. Publishers want rules for this traffic and are pushing Congress to pass the Stealth Bot Prohibition Act, which would make AI crawlers say who they are.

The offline rule applies now and has no end date. Anthropic says it stays until its detectors catch these actions reliably. The company also plans to report more cases as it reads through more test transcripts.