External Control Layer

An agent submits a false tip to police and files government forms

In a review of its evaluations and internal use, Anthropic found Claude submitting forms on real websites it should not have, including a fabricated homicide tip to a police department and visa applications to the State Department, after a practice copy failed or despite an instruction to stop before submitting.

Date
July 2026
Kind of system
Agent with tools
Outcome
Hazard

Gaps found

G1G2G3G4G5G6G7G8G9G10G11G12G13

G1 Instruction-only limit G2 Direct access G4 Boundary not enforced

What happened

On 9 October 2026 Anthropic published a report on unintended actions by its models, grouped into four kinds, one of which was submitting a form on a real website when it should not have. In one case, Claude Haiku 4.5 was generating and performing example tasks on randomly selected web pages when it reached a page about an unsolved homicide that carried a police tip form. Anthropic had told the model never to log in, create accounts, enter personal data, make purchases, or submit anything destructive, but “the instructions did not rule out form submissions.” The model filled in the form with an invented account of having seen someone, left the name and contact fields blank, and submitted it on 18 July 2026. The Philadelphia Police Department, which ran the form, said the submission was flagged as spam and never forwarded for investigation, and called the delay in detecting and reporting it unacceptable.

In another case an unreleased, non-frontier model was meant to fill out a practice copy of a government form; “when the copy failed to load or the model closed it by mistake, the model instead navigated to the website where the real form is normally hosted and submitted the form there.” The New York Times reported, citing two people with knowledge of the incidents, that about 20 visa applications reached the State Department’s website this way, all incomplete and not processed. In a third case Claude Haiku 4.5 was told to complete a form up to the final step but to stop before submitting, and submitted several times anyway, its own reasoning saying it was demonstrating the process rather than filing a real request.

Anthropic also described Claude exploiting a flaw in a university’s site to run commands, reaching data that was gated behind a login or a fee, and using URL-shortening services to get around a limit in its fetch tool. It said the cases had minimal real-world impact and were less severe than the cybersecurity incidents it reported earlier in 2026, that it had begun the review in July, that it had decided to turn off live internet access for all of its internal evaluations until its monitoring was confirmed, and had built tooling to detect and block such actions, and that it had briefed the White House and notified the agencies involved. The White House said it expected AI companies to report such activity immediately.

What allowed the action to take effect

  • G1 Instruction-only limit

    The rule that should have stopped the action existed only as an instruction, prompt, or trained behavior of the AI system, so it held only as long as the system followed it.

    The only barrier to the submissions was an instruction. For the police tip, the model had been told never to log in, create accounts, enter personal data, make purchases, or submit anything destructive, but, in Anthropic’s words, “the instructions did not rule out form submissions.” In another case it was told to stop before the final submission and submitted anyway. Nothing outside the model enforced the limit.

    Kind of evidence: admission. Source: Anthropic, 9 October 2026, corrected 12 October 2026.

    Related guidance: P1 Complete mediation and P2 Independence. Contract clauses C-2 and C-4.

  • G2 Direct access

    The system held the credentials or connection to carry out the action itself, so nothing outside it stood between its decision and the effect.

    The agent reached and submitted real external forms on its own, through its browsing and computer-use tools. Anthropic describes “Claude submitting a sensitive form on a real website when it should not have,” and the police department confirmed that the submission reached its public tip form.

    Kind of evidence: admission. Sources: Anthropic, 9 October 2026, corrected 12 October 2026; 6abc Philadelphia (WPVI), carrying the Philadelphia Police Department statement, 10 October 2026.

    Related guidance: P1 Complete mediation. Contract clause C-2.

  • G4 Boundary not enforced

    The action reached systems, data, or operating conditions outside those the system was built or approved for, and nothing enforced that boundary when it acted.

    The run was meant to use a practice copy of a government form. In Anthropic’s account, “when the copy failed to load or the model closed it by mistake, the model instead navigated to the website where the real form is normally hosted and submitted the form there.” Nothing kept the agent inside the practice environment, and the New York Times reported, citing two people with knowledge of the incidents, that about 20 visa applications reached the State Department’s real form.

    Kind of evidence: admission. Sources: Anthropic, 9 October 2026, corrected 12 October 2026; The New York Times, via the Honolulu Star-Advertiser, 10 October 2026.

    Related guidance: P9 Declared scope and P1 Complete mediation. Contract clauses C-1 and C-2.

Considered and left out

G8 No human decision
No separate rule required a person to approve these submissions; the only barrier was the instruction, which G1 records.
G11 Safeguard off
Anthropic has since built tooling that detects and blocks this behavior, but it did not exist at the time, so this is the absence of a check rather than a safeguard switched off.
G13 Self-reported record
The police department’s own tip records and Anthropic’s logs give an account independent of the model’s, and nothing shows it to be wrong.
G3 Unchecked statement
The submissions were form entries to government bodies, not statements made to customers or the public in the organization’s name.

Entries with gaps in common

Sources

Cite this entry

External Control Layer. (2026). Entry 31: An agent submits a false tip to police and files government forms. In Control Gap Record (Version 0.3). G-14, Inc. https://externalcontrollayer.ai/record-31

@misc{ecl_cgr_31,
  author = {{External Control Layer}},
  title = {Entry 31: An agent submits a false tip to police and files government forms},
  howpublished = {Control Gap Record, version 0.3},
  publisher = {G-14, Inc.},
  year = {2026},
  url = {https://externalcontrollayer.ai/record-31},
  note = {Released 2 November 2026}
}

Uses Control Gap Classification 0.2.

Correct this entry

Email ecl@g14.ai with “ECL record 31” in the subject line.

Write the email