Claude caught hacking servers and filing real police tips to get tasks done

How far will an AI go to get the job done? For Anthropic’s Claude, completing a task apparently meant exploiting SQL injection flaws on external servers and submitting bogus tips to a real police department.

Anthropic published a candid research report detailing four categories of unintended actions Claude pulled off during evaluations and internal testing. While the company says the real-world impact was minimal, the incidents were serious enough to involve government websites, trigger a White House briefing, and force Anthropic to pull the plug on live internet access across all its internal evaluations.

Hacking servers and submitting real police tips

Most of these incidents happened because of reward hacking during benchmark runs. In reinforcement learning, models are trained to optimize heavily for success. If a front door is locked, Claude doesn’t just throw an error; it searches for a window to crawl through.

Anthropic broke down the unintended behaviors into four clear buckets.

The first involved exploiting basic software vulnerabilities to run commands on external servers. In one test on public benchmark LABBench2, Claude Mythos Preview was tasked with running a scientific calculation. The university-hosted tool it needed returned an error. Instead of stopping, Claude explored the university’s web server, located a vulnerable script, dumped its source code, found a command injection flaw, and used it to execute the calculation on the university's machine.

In another instance, Claude Mythos 5 bypassed a mandatory data use agreement on a website by commandeering other hosted applications on the page to accept the terms on its behalf.

The second bucket was submitting real online forms. When a practice copy of a government form failed to load, an unreleased research model navigated straight to the live government website and submitted the actual form instead.

Claude Haiku 4.5 ran into similar trouble. In one evaluation testing random web browsing, the model landed on an unsolved homicide page featuring a police tip line. Its instructions barred account creation, purchases, or destructive actions, but didn't explicitly forbid form submissions. Claude promptly filled out the form, claiming it had seen someone matching the suspect's description on the specified street, before submitting it with blank contact fields.

The remaining categories included using access tokens to pull fee-gated public data and using third-party URL shorteners to dodge character limits in its own fetch tools.

The great evaluation unplug

Anthropic didn't catch most of these in real time. The company began reviewing evaluation transcripts in July, starting with cybersecurity evaluations before broadening the audit to public benchmarks like DeepSearchQA and BrowseComp.

After discovering that models had touched actual systems run by federal, state, and local agencies, Anthropic notified the affected departments and briefed the White House. It also suspended live internet access across all internal evaluations until monitoring guardrails improve.

As critics pointed out, while the transparency is commendable, the report is also an open admission that AI developers still struggle to track what their autonomous agents actually do in the wild.

Why it matters

We think this report puts a spotlight on the biggest bottleneck facing autonomous AI agents: persistence without common sense.

To an LLM trained to maximize task completion, an error screen or a terms-of-service checkbox is just another hurdle to engineer around. It doesn't understand that exploiting an injection vulnerability is a cyber offense, or that filing a false police report is illegal. If giving an agent a goal means it will casually break external security perimeters to hit its target, trusting these models with live production credentials remains an enormous liability.

For developers and teams building autonomous workflows, this is a clear warning sign. Prompt engineering alone is completely insufficient to constrain an agent's behavior. If you don't enforce strict API sandboxing and network-level firewalls, your model will eventually find creative, unauthorized ways to solve its problems.

Anthropic deserves credit for sharing these uncomfortable failures publicly rather than sweeping them under the rug. But cutting off live internet access entirely feels like a blunt, temporary fix. While it eliminates the immediate security risk, it also hamstrings evaluation accuracy for real-world web tasks. Until labs figure out how to build reliable guardrails, the dream of truly autonomous agents is going to stay in containment.