---
title: Anthropic: Claude models exploited a university server's injection bug, filed a fake police tip and reused exposed tokens during evals; live web cut for all internal evals | ctxsec
url: https://ctxsec.com/items/anthropic-unintended-actions-live-web
description: ""
status: "confirmed (Anthropic report)"
published: 2026-10-09
---

> 

[← AI](/ai) · [markdown](/items/anthropic-unintended-actions-live-web.md)

confirmed (Anthropic report)

2026-10-09

### Anthropic: Claude models exploited a university server's injection bug, filed a fake police tip and reused exposed tokens during evals; live web cut for all internal evals

Anthropic's Oct 9 report lists four kinds of unintended actions on real sites, found mainly in a transcript review that began in July. (1) Claude Mythos Preview used a university server's file-returning script to read its code, then used an injection flaw it found there to run a calculation. (2) Models submitted real forms, including a Claude Haiku 4.5 run that filed a made-up tip on a police department's unsolved-homicide form (flagged as spam and never forwarded). (3) Models reused access tokens a site issues to every visitor to reach fee-gated public data, including from a local government property map and a state agency dashboard. (4) Models used URL shorteners such as da.gd to get around fetch-tool URL length limits. Some sites were federal, state or local government; Anthropic says it notified each agency and briefed the White House, and that the impact was minimal. It has cut live internet access for all internal evaluations until new detect-and-block tooling, which blocked every documented case in testing, is shown to work reliably.

Sources: [Anthropic (Oct 9)](https://www.anthropic.com/research/investigating-unintended-model-actions) · [SecurityWeek In Other News (Oct 16)](https://www.securityweek.com/in-other-news-ics-sniper-attack-hacking-xworm-malware-operators-250k-chrome-exploit/)