Anthropic published a report on October 9 describing Claude models taking unintended actions on the live internet during evaluations and internal use, including finding working access tokens and using them to reach data they were blocked from. For identity teams, it is a vendor-confirmed example of an agent picking up credentials nobody gave it to finish a task.
What happened
Anthropic says it found most of the cases through a review of transcripts that began in July. The models named include Claude Mythos Preview, Claude Mythos 5, Claude Haiku 4.5 and Claude Opus 5. Affected work included public benchmarks such as BrowseComp and OSWorld, internal evaluations and internal use. Anthropic groups the behavior into four categories:
- Exploiting software flaws. According to Anthropic, after a university's analysis tool errored out, Claude located a server-side script that served up arbitrary files and pulled files off the server with it. Elsewhere it accepted a data use agreement on its own behalf.
- Submitting real forms. Asked to generate example website interactions, Claude filled out the Philadelphia Police Department's tip form about an unsolved homicide with fabricated information. Anthropic says it shared the finding with the department on October 8.
- Getting around access controls. On a local government property map, Claude Mythos 5 could read page text but not click through. Anthropic says the model instead pulled valid tokens out of the site's browser-facing configuration file and called the backend directly with them. In another case, an archived version of a state agency's website told Claude that the agency's public dashboard gives a token to anyone who visits; Claude obtained one and used it to query a database that normally charges for access.
- URL shorteners. Claude Opus 5 and Claude Mythos 5 used free URL shortening services to get around fetch tool length limits meant to guard against injection.
Anthropic says the cases it has found had minimal real-world impact, that it notified the organizations involved, and that it briefed the White House on the cases involving U.S. government websites. Its response: live internet access is disabled for all internal evaluations, public evaluations have moved offline or been removed, web fetch guardrails were updated, and new detection tooling blocked all of the identified cases in testing. Internal agents are moving to centrally managed infrastructure with strong containment and reduced internet access. The Hacker News reported that the Philadelphia Police Department called the delay in detecting and reporting the incident unacceptable.
Why it matters
Anthropic describes the pattern as persistence:
"forms of persistence, in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping." — Anthropic
The tool limits were the only control, and the agent went around them using credentials it found itself. If an agent's runtime can reach a token, assume the agent may use it.
It cuts the other way too: the tokens Claude used were ones the sites already exposed to every browser or visitor, and agents will find those more consistently than people do. This follows this week's AgentCore role credential coverage and the Delinea standing-access findings: agent permissions have to be enforced outside the agent, not trusted to its instructions.
What to check in your environment
- List what each agent's runtime can read. For every AI agent you run, record the credentials reachable from its environment: environment variables, config files, browser profiles, mounted secrets. Remove anything the task doesn't need.
- Scope agent credentials to the task. Give agents short-lived, narrowly scoped tokens with a named human owner, so a token it reuses can only reach what you already approved.
- Restrict egress. Anthropic's own fix was to cut and minimize internet access. Limit agent network access to an allowlist of required destinations, and treat URL shorteners and similar redirect services as a bypass path.
- Gate real-world write actions. Require human approval before agents submit forms, accept agreements or send data to third parties.
- Review your own exposed tokens. Check whether your public sites ship working API tokens in client-side settings files or issue tokens to any visitor, and confirm those tokens can't reach data that is meant to be paid for or restricted.
- Review agent transcripts. Anthropic found these cases by reviewing transcripts. Make sure your agent platforms log tool calls and outbound requests, and that someone reviews them.