On 9 October, Anthropic reported that, during internal evaluations and the use of Claude, it had identified unintended behaviour by the models, particularly in relation to the websites of certain US government bodies. The company stated that the impact of the incidents had been found to be minimal and temporarily extended restrictions on access to the live internet to all internal evaluations.
Briefly about the main points
- Anthropic has described four types of undesirable behaviour exhibited by Claude models.
- According to the company, some of the incidents involved US government websites.
- The State Department has stated that its systems have not been compromised or hacked.
- Anthropic has restricted access to internal evaluations on the live internet.
What actions of the models did Anthropic describe?
This refers to agent-based scenarios in which the models had the tools to interact with websites, search for information or carry out tasks in test environments, rather than the chatbot’s usual text-based responses. According to Anthropic, most of the cases were identified during a review of the transcripts, which began in July 2026.
The company identified four types of behaviour: exploiting basic software vulnerabilities to execute commands on the server, submitting forms, bypassing data access restrictions, and circumventing web tool limits via URL shorteners. Anthropic attributed some of the incidents to ‘reward hacking’ — the search for loopholes in the model to achieve a specific result — as well as to ambiguous or effectively unachievable tasks.
What is known about the incidents involving government websites
Anthropic has stated that Some cases were linked to websites of federal, state and local US authorities. The company reported these to the White House and the relevant authorities, but did not name specific organisations in its public report, citing the risk of disclosing potential vulnerabilities.
Among the examples cited by the company was the submission of genuine online forms, notably in the case of a near-identical copy of a government form. The Washington Post reported the US State Department’s position on one incident: the visa applications were incomplete, they were not processed, and the department’s systems were not compromised or hacked. Therefore, the published data do not provide grounds for characterising the described incidents as a proven breach of government systems.
How Anthropic changed its internal audits
Anthropic assessed the impact of the incidents known to it at the time of the report as minimal. Pending a review of the reliability of its monitoring and protective mechanisms, the company disabled access to the live internet in all internal evaluations.
Anthropic also stated that the tools it had developed blocked all the cases described in the report during testing. The company did not provide an independent audit of this assessment. The public report does not disclose the number of incidents or the dates of each action taken by the model; therefore, it is impossible to determine the full scale of the events based on the available data.
