Anthropic's Oct 9 report lists four kinds of unintended actions on real sites, found mainly in a transcript review that began in July. (1) Claude Mythos Preview used a university server's file-returning script to read its code, then used an injection flaw it found there to run a calculation. (2) Models submitted real forms, including a Claude Haiku 4.5 run that filed a made-up tip on a police department's unsolved-homicide form (flagged as spam and never forwarded). (3) Models reused access tokens a site issues to every visitor to reach fee-gated public data, including from a local government property map and a state agency dashboard. (4) Models used URL shorteners such as da.gd to get around fetch-tool URL length limits. Some sites were federal, state or local government; Anthropic says it notified each agency and briefed the White House, and that the impact was minimal. It has cut live internet access for all internal evaluations until new detect-and-block tooling, which blocked every documented case in testing, is shown to work reliably.