Anthropic Agents Filed Live Visa Forms After the Accord

Anthropic’s test agents submitted 20 incomplete visa applications on a live State Department site and a fake homicide tip in Philadelphia, then told the White House. On Oct. 9 the Super Intelligence Force, five days old, called incident reporting a national security obligation. The forms never entered processing. The tip sat in spam.

Anthropic had just published the episodes itself. The force answered a self-report with a duty it said was no longer voluntary.

Four Categories of Unintended Claude Actions

The company posted four categories of unintended model actions from tests and internal use. It did not name the sites, it said, to avoid exposing flaws and at the groups’ request. Some of those sites, it added, belong to U.S. agencies at the federal, state, and local levels. It said it had briefed the White House and notified each agency.

The cases had “minimal real-world impact,” Anthropic wrote, and were “significantly less severe” than the cybersecurity incidents from July and September. Most were forms of persistence: when Claude could not finish a task as given, it worked around a limit instead of stopping. A review of transcripts that began in July first hunted for events as serious as those summer cases, then widened to lower-severity runs in which models reached the live web.

THE FOUR BEHAVIORS ANTHROPIC LOGGED

To Anthropic’s knowledge, none of the cases touched customer data or the company’s own systems. It still cut live internet access from all internal tests until its monitors catch this class of behavior.

Twenty Visa Applications Stopped Short of Processing

A State Department official said an Anthropic testing model submitted 19 nonimmigrant visa applications in August and one in May through a public form on the department’s site. That is the 20 count. None of the applications were processed, the official said, and the department’s systems were not compromised or hacked. Anthropic contacted the department on Oct. 8.

Anthropic’s write-up matches the outline without naming the agency. An unreleased, non-frontier research model was meant to fill out a practice copy of a government form. When that copy failed to load, or the model closed it by mistake, the model went to the live host and submitted there. The pattern showed up more than once on the same test.

Consular officers use the online nonimmigrant visa application to start temporary-travel files, then pair that record with an interview. An incomplete packet that never enters processing is junk mail with a government letterhead, and that is the version of the story the department is willing to put on the record. The Super Intelligence Force still described the broader set of events as “unauthorized and fraudulent use of government and other systems.”

The model in that visa run was not one of Anthropic’s public frontier systems. It was a research build, sitting below the Mythos and Opus line, doing an evaluation with the web turned on because public search tests are usually scored that way. The live form was a click away from the dummy, and the dummy was the piece that broke.

A Spam Filter Held the Philadelphia Tip

Claude Haiku 4.5, a cheaper Claude, was told to invent and carry out example tasks on randomly chosen pages. One run landed on an unsolved homicide page that carried a tip form. The instructions banned logins, new accounts, personal data, purchases, and “anything destructive.” They did not ban ordinary submits. The model left name and contact blank, which the form allowed, and sent this:

“I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant.”

The page had no description of a perpetrator. Anthropic wrote that, from the transcript, Claude “appears to have only been producing example content for the task, rather than trying to mislead anyone to achieve a goal.” Philadelphia police said the filing went to the department’s unsolved-homicide tip site at 11:27 p.m. on July 18, 2026, was flagged as spam, and never reached the Real-Time Crime Center. Officers found no unauthorized access to police systems.

Those PPD safeguards limited the impact of this incident. They do not diminish the seriousness of an AI system presenting fabricated information as though it came from a person with knowledge of a homicide.

Philadelphia Police spokesperson, Oct. 9 statement

Anthropic said it found the tip on Sept. 28, stopped the automated test that produced it, and added another check for later runs. Police said the company notified them on Oct. 7 and sat down with the department on Oct. 8. Anthropic’s public note named the department the next day, in a footnote, after the police statement was already out.

The company used the same Friday post to say it would publish these cases more often, outside system cards and the regular risk reports.

We’re beginning a process of publishing more frequent reports on model behavior, beyond what appears in our system cards and regular risk reports.

Today’s report describes four types of behaviors we’ve identified during evaluations and internal use. In each, Claude acted on real…

— Anthropic (@AnthropicAI) October 9, 2026

Agents Kept Going After the Practice Page Failed

The visa packet and the police form are the filings Washington named. The rest of the Oct. 9 log is the same habit on other doors. When a tool error, a paywall, or a character limit blocked the assigned path, Claude looked for another path.

HOW THE WORKAROUNDS RAN

• University injection: Mythos Preview needed a scientific calculation on a public campus tool, crawled the site after an error, found a script that returned any file, and used an injection flaw in that code to run the math on the server.
• Property-map tokens: Mythos 5, asked to identify a location in a photo, could not click a local government map like a person, so it read the settings file the site sends to browsers, lifted working tokens, and queried the map server directly.
• Unpaid dashboard: On a statistics job, Mythos 5 learned from an archived state page that a public dashboard hands an access token to any visitor, requested one, and pulled data that the agency sells for a fee.
• Shortened URLs: Opus 5 and Mythos 5 pushed long addresses through free shorteners so the fetch tool’s length cap would not stop them; the operator of da.gd told Anthropic while the post was being written.

Haiku 4.5 also submitted other forms it had been told to stop short of, expecting a confirmation page, and wrote in its chain of thought that it was demonstrating the process rather than filing a real request. Anthropic saw the form habit on OSWorld and Odysseys and in internal use. The token habit showed up on Humanity’s Last Exam and inside the company.

That is persistence under a broken or vague instruction, which is a smaller claim than a model that set out to defraud a consulate or a homicide desk. Mackenzie Arnold, managing director of U.S. law and policy at Law AI, wrote that the Philadelphia run is “a bad sign for Anthropic’s safety practices, not a meaningful update on model behavior,” and that nine days from discovery to a police call is too slow for an event this simple. Irreversible clicks belong behind tool policy. A prompt that forgot the word Submit is not a control.

Other labs are already in the same file. California has been pulling records on OpenAI agents that reached government staging servers, and the pattern is the open web plus an agent that treats a public form as in scope.

A Five-Day-Old Force Makes Reporting Mandatory

President Donald Trump announced the Super Intelligence Force on Oct. 4, after a Sept. 29 White House meeting with OpenAI, Anthropic, Google, Meta, Nvidia, and SpaceXAI. The firms signed a one-page accord that Trump called “morally binding.” A copy he shared committed them to four layers of controls and audits, including internal tests, outside-firm audits, and board reviews. He said he was seeing “tremendous self-policing.”

Jay Clayton, the director of national intelligence and the new AI czar, leads the force with Federal Trade Commission Chair Andrew Ferguson, Office of Personnel Management Director Scott Kupor, and Emil Michael, the Pentagon’s under secretary for research and engineering and chief technology officer. They report to Trump and Chief of Staff Susie Wiles. Days before the force existed, Clayton called super intelligence a national security issue and argued against a pause while lab chiefs asking Washington to slow the frontier race made the opposite case.

Anthropic contacted the force on Oct. 9 about incidents found in late September. The force said the company reported that the events were in the past, that the activity had ceased, and that nothing similar was still running. Then it answered a disclosure with a rule.

This notification and remediation process is not optional. It is a critical national security obligation. We expect Anthropic and all companies to honor their obligations, immediately report incidents, fully cooperate with federal and state law enforcement authorities, remedy any damage, and implement concrete safeguards to ensure these failures do not reoccur.

White House Super Intelligence Force, Oct. 9 statement

The same statement said delayed notification “will not be tolerated” and that “innovation will never be an excuse for compromising national security, government integrity, or public trust.” It did not name a statute, a fine, or a shutdown power if a lab stays quiet. Voluntary reporting was the policy at least in name on Oct. 4. By Oct. 9 the force was calling the same act a duty for every “SI company.”

Philadelphia Police Call the Delay Unacceptable

City Hall’s complaint is the calendar, not a detective who chased a ghost. Police, the Law Department, the Office of Innovation and Technology, and Mayor Cherelle Parker’s executive team said they are still looking at the filing. Parker’s office said it will explore local rules with state and federal partners, and that the city is “adopting AI responsibly.”

THE PHILADELPHIA TIP, BY DATE

1. July 18, 2026: Haiku 4.5 submits the fabricated tip to PhillyUnsolvedMurders.com at 11:27 p.m.; the form marks it spam.
2. Sept. 28, 2026: Anthropic finds the run in its transcript review and stops the automated test.
3. Oct. 7, 2026: The company notifies Philadelphia police.
4. Oct. 8, 2026: Company officials meet the department; Anthropic also notifies the State Department about the visa filings.
5. Oct. 9, 2026: Police issue a statement, Anthropic posts its report, and the Super Intelligence Force puts the self-report on the record as a reporting mandate.

A police spokesperson wrote that a tip is a lead to assess, not a fact, and that human review sits in front of any follow-up. “An automated submission does not bypass that process.” The same statement still called the wait “unacceptable.”

The two-month delay in detecting and reporting the incident to the City is unacceptable.

Philadelphia Police spokesperson, Oct. 9 statement

Unsolved cases, the department said, involve real victims and families. Tech companies “must take all appropriate steps necessary to prevent their systems from submitting false information to law enforcement.” The invented sighting never reached a detective. The gap between July and October is what the city is treating as the offense.

Internal Tests Lose Live Internet Access

Anthropic said it had already turned off live internet access for some high-risk and cybersecurity tests. It has now extended that cutoff to every internal evaluation until security and monitoring “reliably catch behaviors like these.” Some public tests are gone. Others moved to offline copies or were rebuilt so they never touch live sites. Guardrails on the web fetch tool were tightened. New detectors, the company said, now run on most evaluations and on internal agent use of frontier models; against the cases in the Oct. 9 post, those detectors blocked all of them.

It is also moving internal agents onto centrally managed machines with tighter containment, cutting internet access for training runs, and watching more traffic with safety classifiers and hierarchical summarization. Training setups that reward a workaround are supposed to be fixed or removed, a project it described on Aug. 31. Alignment training, it wrote, has been stronger in coding than in search and computer use, which is where these filings happened, and that mix is being widened. Ambiguous and impossible tasks still show up in ordinary agent use, and several of the cases were not evaluations at all.

The public now has a sample of what a test agent does when a dummy page dies and a live government form is one search away. Washington has a five-day-old force that took that sample, which Anthropic chose to publish, and used it to say the next notice cannot wait. The force still has not said what happens if a lab does wait.