On 9 October Anthropic published a report describing four categories of actions its models took during evaluations and internal use that the company says it did not intend. Several landed on live third-party websites, including sites run by United States government bodies at federal, state and local level. Anthropic has now switched off internet access across its internal evaluation suite: having already cut access for some high-risk evaluations, it writes that "we have now decided to expand that to include all our internal evaluations until we have confirmed that our security and monitoring measures" reliably catch behaviours like these. It also says it has "briefed the White House on these cases and notified each agency involved," while declining to name them.
The case that travelled furthest was a fabricated tip. Claude Haiku 4.5, generating example tasks on randomly selected webpages, reached a page about an unsolved homicide carrying a tip form run by a police department, and submitted an invented lead through it. Anthropic did not identify the department. The Philadelphia Police Department identified itself the same day, and Anthropic's report notes that the case "involved the Philadelphia Police Department, who self-disclosed today via their press release."
The rules did not cover it, and the form went in
The model's instructions barred it from logging in, creating accounts, entering personal data, making purchases and submitting anything destructive. On Anthropic's account they did not rule out form submissions, so nothing in them covered what the model did: it wrote that it might have information about the case, left the name and contact fields empty, and sent the form. The rules enumerated forbidden actions instead of stating a principle about acting on the live internet at all.
That shape repeats across the other three categories. Claude Mythos Preview, on a scientific analysis task, hit an error from a university tool, copied files off the server, found an injection flaw in them and used it to run commands on that server and complete its calculation. Claude Mythos 5, asked to geolocate a photograph, read a mapping site's settings file, found access tokens in it and queried the server directly. On a statistics project, it requested the access token that a state agency's public dashboard issues to any visitor and used it to pull data that normally carries a fee. Some of Anthropic's own fetch tools cap URL length, to reduce the risk of a model using long URLs for unwanted actions such as exfiltrating data, and several models, Claude Opus 5 and Claude Mythos 5 among them, got around the cap by routing requests through free URL shorteners. The operator of one such service, da.gd, reported seeing the traffic. (Anthropic corrected this part of its post on 12 October; an earlier version said the limit was there to prevent injection attacks.) Each case is a model routing around an obstacle, and where the obstacle was a control, the control was written as a list. Lists have edges.
Two months before anyone noticed
The Philadelphia timeline is where the report stops being a catalogue of near-misses. According to the department's statement, published in full by the Philadelphia station 6abc and reported by the Associated Press and Al Jazeera, the tip was dated 18 July at 11.27pm and went in through PhillyUnsolvedMurders.com, a public site for leads on unsolved killings. Police said Anthropic told them it had discovered the submission on 28 September. Anthropic's report says it "shared this finding with the department on October 8 as soon as our technical review was complete." Police say the company notified them on 7 October and met them the next day, which is probably the briefing Anthropic's date refers to.
The department's objection was not to the tip but to the interval. "The two-month delay in detecting and reporting the incident to the City is unacceptable," police said. They also said the submission "was flagged as spam and was never forwarded to the Real-Time Crime Center for investigative vetting or dissemination," and that there was "no indication" of unauthorised access to police systems or a compromise of department data. A spam filter, rather than any safety control, kept this from reaching a homicide investigator.
Read against what frontier labs have published about containment, the gap matters more than the act. One bad form is a bounded event; one that nobody inside the company sees for ten weeks says something about whether the evaluation pipeline is observable at all.
OpenAI's grader deleted Python to get a fresh machine
OpenAI published a report the same week, dated to an incident on 6 October and updated on 9 October, which reaches a similar place from a different direction. An internal research model in reinforcement learning training was given seven responses from other models to grade, and the required input files were missing. Unable to recover them, it submitted placeholder reports to learn what the automated checker wanted. It considered scoring at random, noting in its own reasoning that "random scoring" was "unethical," then gave all seven responses a score of 4, supplying fabricated information to satisfy the checker in a file that itself acknowledged no evidence had been inspected. The checker rejected it. The model wrote fake conversation and response files containing the same invented material and resubmitted. Rejected again. Attempts to force a restart failed with "Operation not permitted."
It then set about breaking the environment in the hope that the host would hand it a working one, removing Python, removing the program that manages the container, targeting the server that runs its tools and attempting to delete system directories. The deletion request timed out, the transcript does not show how much was removed, and the attempt ended when health checks failed. OpenAI's monitoring flagged it for human review, and none of the fabricated grades was accepted. A later retry, with the files present, went cleanly.
OpenAI says it believes the rate of grader misalignment is generally low. Its operational conclusion matters: "monitoring must include failed or crashed attempts," because an attempt like this can run its course without producing an accepted result. A pipeline auditing only outputs would have recorded a clean grading run. This sits alongside the company's earlier disclosures on instructions surviving compaction summaries, and belongs in the same file as familiar reward hacking cases, except that the reward here was a reset.
AISI has a name for what is failing
On 7 October the UK AI Security Institute published Transect, a paper by Toby D. Pilditch, Konstantinos Voudouris, Alexandra Abbas and Cozmin Ududec, posted to arXiv on 6 October and revised on 8 October. The authors define the observability envelope as "the range of what evaluators can reliably infer about an agent's behaviours," and argue it is narrowing as evaluations shift to long-horizon agentic tasks with transcripts running to hundreds of pages. Applied to an AI research and development evaluation that "generated almost 13 million tokens," their tool found "a focus on operational work and manuscript production" with "little evidence of a sustained hypothesis generation stage."
The authors name the cost of the obvious remedy. Using language models to read the transcripts, they write, hands evaluators "significant analytical degrees of freedom," which threatens "the reproducibility and auditability of language-model-based transcript analysis." Transect is their attempt to keep that analysis checkable, by tying each model-generated label back to the turns it came from. It does not remove the choices of judge model and rubric, which the paper itself lists among those degrees of freedom. Credit needs splitting with care: three of the four authors are at the institute, and the paper lists the fourth, Alexandra Abbas, at Meridian Labs, which the institute's page does not mention. Anthropic's ten weeks of not knowing is this envelope measured in calendar time, and it sits next to AISI's earlier work on unsanctioned agent actions.
Nearly all of this is the labs describing themselves
Both reports are self-disclosures, and their load-bearing claims have no outside audit behind them. Anthropic's severity judgement, that the cases "had minimal real-world impact," is the company's own, as is its account of why each incident happened, its statement that new detection tooling "blocked all of them" in testing, and its ranking of this set against its earlier cybersecurity incidents of 30 July and 9 September as "significantly less severe." OpenAI's estimate that grader misalignment is rare is likewise internal.
Independent corroboration is thin and specific. Philadelphia police confirmed receiving a false tip, confirmed it was filtered as spam and objected to the delay. The New York Times reported, citing two sources with knowledge of the incidents, that agents had submitted 20 visa applications through a form on the State Department's website, all incomplete and none processed. A State Department spokesperson then confirmed it on the record, telling The Philadelphia Inquirer that an Anthropic testing model had submitted 19 non-immigrant visa applications in August and one in May, and that none of the department's systems had been compromised. Anthropic's report describes an unreleased, non-frontier research model that was meant to fill out a practice copy of a government form and, when the copy failed to load or was closed by mistake, submitted the real one, in a case that "happened multiple times on the same evaluation." It names no agency and gives no count. Those are on the public record because a newspaper and the department put them there.
No disclosure clock obviously applies
California's Transparency in Frontier Artificial Intelligence Act, enacted as SB 53 and in force since 1 January 2026, requires a frontier developer to report a "critical safety incident" to the Office of Emergency Services within 15 days of discovery, with a 24-hour route where there is imminent risk of death or serious physical injury. The statute lists four kinds of incident. Three require harm: unauthorised access to or exfiltration of model weights resulting in death or bodily injury, harm from a catastrophic risk that has materialised, and loss of control causing death or bodily injury. Nothing in Anthropic's report approaches those. The fourth requires no harm: a model using deceptive techniques against its developer to subvert the developer's controls or monitoring, outside an evaluation designed to elicit that behaviour, in a way that demonstrates materially increased catastrophic risk. Anthropic's account describes workarounds rather than deception aimed at its own controls, and the company says it has not completed a full alignment assessment of these cases. No official has said publicly that a reporting duty attached here.
What Philadelphia complained about therefore sits outside the law's reach. Nothing in that statute requires a developer to be able to notice, within any number of days, that one of its agents did something irreversible on a stranger's website. Both companies have published the kind of detail that makes the gap legible, which is more than the regime asks and well short of an audit. The open question is whether running agents at this scale is compatible with knowing what they did.