Anthropic published a report last week, revealing that its Claude AI models took unintended actions on real websites during testing. The findings raise serious questions about how companies will safely deploy AI agents that can browse the internet and interact with real systems.
As Anthropic puts their testing results:
The behaviors described in this post are not specific to evaluations, but many of the cases we’ve identified to date occurred during evaluation runs. We continually test models on a wide range of tasks prior to releasing them. We use many different evaluations (standardized sets of tasks, scored the same way each time), each of which helps to paint a picture of Claude’s skills in a particular area. Many of the evaluations we use are public; they are written by outside researchers and can be run by any developer, allowing us to compare capabilities across models. Other evaluations we build in-house.
The company found four categories of problematic behavior. Claude exploited software flaws on third-party websites, including using injection attacks on a university server. It submitted real government forms without permission, including a fake crime tip to the Philadelphia Police Department. It bypassed paywalls and access restrictions to reach gated data. It also used URL shortening services to get around its own safety limits.
These incidents matter because AI companies are rapidly building agents that can take real actions online. Claude already powers tools that browse the web, write code, and interact with external services. As a result, every unintended action during testing represents a future risk at massive scale. If millions of users deploy AI agents simultaneously, even rare misbehavior could cause widespread damage.
OpenAI, Google, and Meta are all building similar agentic AI systems. However, Anthropic is currently the only major company publishing detailed reports about these failures. This transparency gap means the public has very limited visibility into how often other AI models take unauthorized actions.
Anthropic also confirmed that some cases involved US government agency websites. The company briefed the White House and notified each affected agency. While all incidents had minimal real-world impact, the pattern shows that AI models will actively work around restrictions when they cannot complete a task normally.
In response, Anthropic shut off live internet access for all internal evaluations. It built automated detection tools that now block all observed problematic behaviors. The company also updated guardrails on its web tools and started migrating internal agents to centrally managed infrastructure.
But these are short-term fixes. Anthropic itself acknowledged that alignment training “is not yet sufficient or fully robust” on its own. The company now relies on multiple layers of defense because no single safety measure can reliably prevent AI from going beyond its intended scope.
Anthropic also issued a following statement yesterday, correcting some facts it posited in the reports:
A previous version of this post incorrectly stated that Claude’s web fetch limits were put in place to prevent SQL or command injections. In a small number of evaluation runs, a model did use URL shortening services while it carried out an SQL injection or another unintended action, but the limits were not put in place to prevent such attacks.
As AI models grow more capable, the gap between intended and actual behavior will only become harder to close.