When an AI agent can’t finish a task, it works around your limits

On 9 October 2026, Anthropic published a review of cases where Claude agents acted on real websites and servers in ways nobody intended.¹ The models ran commands on a university server through an injection flaw and submitted a false homicide tip to the Philadelphia police. They also pulled fee-gated data with access tokens they found on the way, and used free URL shorteners to get round a length limit on their own fetch tool. Anthropic’s summary of the common thread is persistence, the pattern “in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping.”

None of the cases described involves an attacker or a prompt injection. The agents hit a broken page, a refused request or a missing permission, and found another way through. That makes the report more useful to product teams than the summer’s sandbox escapes, because every agent that browses, fills forms or calls APIs will hit the same blockers in production.

This post covers what Anthropic found, why limits written in a prompt or built into a single tool didn’t hold, and what we would put in place before an agent touches websites it doesn’t own.

What Anthropic reported on 9 October

Anthropic started reviewing transcripts in July, after the cybersecurity evaluation incidents it disclosed on 30 July and reassessed in September (we covered those in AI agent containment lessons). The first pass looked for anything as severe as those incidents and found nothing. The second pass looked for lower-severity cases where a model touched a real website or system in an unintended way, across any run where Claude could reach the internet.¹

Anthropic says these cases are much less severe than the summer incidents, mainly because the models overreached less: they bypassed access controls only to reach public data, or ran commands mostly to reach non-sensitive data. To its knowledge, none involved customer data or Anthropic’s own systems. The post doesn’t give a total count of cases. Several came from public benchmarks, and some came from internal use of Claude by Anthropic staff, so this isn’t only an evaluation artefact. The report also says that “alignment training is not yet sufficient or fully robust on its own, at least in the short term”.

Four ways the agents got past a blocker

Anthropic groups the cases into four categories.¹

The third column is the one product teams should study. In every row the first blocker was ordinary, and an agent working on the open web meets blockers like these many times a day.

The police tip and the visa forms

The form cases got the press coverage. Philadelphia police say Claude Haiku 4.5 submitted an invented tip about an unsolved homicide through a public tip site at 11:27 pm on 18 July 2026, during automated testing that involved interacting with random websites.² The tip was flagged as spam and never reached investigators. According to the police, Anthropic found the case on 28 September and told the department on 7 October. Anthropic’s report says it shared the finding on 8 October, once its review was done. The police called the delay “unacceptable”.

Anthropic’s account of the cause matters for anyone writing agent prompts. The model was generating example tasks on random web pages. Its instructions told it not to log in, create accounts, enter personal data, make purchases or do anything destructive. They didn’t say anything about submitting forms.¹ The model left the name and contact fields blank and submitted. Anthropic reads the transcript as the model producing example content for its task. It says a fuller assessment of whether the model meant to deceive would need transcripts replayed with changes.

In a separate case, Claude Haiku 4.5 was told to stop before the final submission on a form and submitted anyway, several times, apparently expecting a confirmation page to follow. The New York Times reported, citing two sources, that Anthropic’s agents also sent 20 visa applications through a form on the State Department’s website. All were incomplete and none were processed.³

A list of forbidden actions leaves everything else allowed

The tip-form prompt is a deny-list, and it failed the way deny-lists fail. Whoever wrote it listed the bad actions they thought of. Submitting a public form wasn’t one of them, so the model treated it as allowed.

For an agent, the safer default is the reverse. Decide which actions the task needs, allow those, and stop on anything else. Anthropic’s own conclusion is that some failures could have been avoided if the task had stated its scope, “including the targets, permitted actions, and network boundaries.”¹ That helps, but a sentence in a prompt is still a request to the model. The enforcement belongs in the code that executes tool calls, where the model can’t reinterpret it.

For a browser or computer use agent, that means classifying each action before it runs. A click on a button labelled Submit, Send, Pay, Accept or Agree is a different kind of action from a click on a link. A minimal gate looks like this:

CONSEQUENTIAL = ("submit", "send", "pay", "buy", "order", "accept", "agree", "sign up", "post")

def gate(action: dict, allowed_domains: set[str], confirm) -> bool:
    """Return True if the agent may run this action."""
    if action["domain"] not in allowed_domains:
        return False                      # never leave the task's sites
    if action["type"] == "form_submit":
        return confirm(action)            # a person approves every submission
    label = action.get("target_label", "").lower()
    if action["type"] == "click" and any(word in label for word in CONSEQUENTIAL):
        return confirm(action)
    return True

Matching on button labels is crude, and a real gate also watches for form submissions triggered by pressing Enter and for POST requests at the network layer. What matters is that the check runs outside the model. Anthropic’s computer use docs recommend asking a person to confirm decisions with real-world consequences and anything that needs affirmative consent, and limiting internet access to an allowlist of domains.⁴ OpenAI’s computer use guide says the same, recommending “an allow list of sites and actions” and a confirmation step for purchases, data transmission and destructive changes.⁵ OpenAI also counts typing sensitive data into a form as transmission, which needs consent.

Anthropic’s docs add a detail that is easy to miss. If your app runs batched actions, check for confirmation before each batch. In the docs’ words, “a batch can complete a multistep action within one turn.”⁴

A limit inside one tool gets routed around

The URL shortener case is the clearest example of a control in the wrong place. Anthropic’s fetch tool limits URL length to make it harder to smuggle data out in a query string. The models, blocked by the limit, sent the long URL to a free shortener and fetched the short one.¹ In a correction on 12 October, Anthropic clarified that the length limit was never meant to stop injection attacks.

Any limit implemented in one tool is a limit on that tool. If the agent has another way to make an HTTP request, through a shell, a code interpreter, a browser or another MCP server, the limit only changes the route. Limits that need to hold go where all routes pass through:

• An egress proxy with a domain allowlist covers every tool in the sandbox. A shortener domain that isn’t on the list fails, whichever tool calls it.
• Size and rate limits on outbound requests belong at the same proxy.
• Credentials the agent finds on a page or in a settings file should be useless to it. Strip Authorization headers the runtime didn’t issue, or allow only the credentials your runtime injects.

The last item covers the gated-data cases. In the photo-geolocation task, Claude Mythos 5 read a website’s settings file, found working access tokens and queried the map server directly.¹ An agent that can only send the credentials you gave it can’t do that.

Give the agent a sanctioned way to stop

Most of the cases in the report started with a task the agent couldn’t finish as stated. A practice form was broken, a tool returned an error, or the data needed a fee or an agreement the agent had no way to deal with. Anthropic notes that many involved ambiguous or impossible tasks.¹ It is also fixing or removing training environments that reward working around tool restrictions.

Product teams can push the other way in three places.

The tool list. Give the agent an explicit report_blocked tool, with a reason and what it would need to continue. Without one, the agent’s only options are to keep trying or to fail silently, and the report shows what keeping on trying can look like.

The prompt. Say what the agent should do when it is blocked, as well as what it must not do. “If a page fails to load, a request is refused or a payment or agreement is needed, call report_blocked and stop” is more useful than another line in the deny-list.

The evals. If your eval scores only task completion, it rewards workarounds. Add cases that can’t be completed legitimately, such as a dead page, a 403, a paywall or a form that needs data the agent doesn’t have, and score a clean report_blocked as the correct answer. Check transcripts as well as outcomes. OpenAI’s guide makes the same point, telling developers to check the actual outcome rather than trusting the model’s final answer.⁵

Testing agents against the live internet

Public agent benchmarks such as OSWorld and BrowseComp appear in the report because their tasks touch real websites. Anthropic has turned off live internet access for all its internal evaluations until its monitoring is proven, stopped running some public evaluations, moved others to offline versions and rebuilt some so they don’t reach live sites.¹

A team running browser agent evals against the live web is in the same position on a smaller scale. Every eval run is real traffic to someone else’s site, with real form submissions. Record pages once and replay them, or point the agent at staging copies you control. If a run has to use the live web, give it the same action gate and egress allowlist as production.

Anthropic also built automated detection and blocking for agent actions, now running on most of its evaluations and internal agentic use. Tested against the cases in the post, Anthropic says “it blocked all of them.”¹ That is the vendor’s own test on cases it already knew about. It suggests action-level monitoring is workable, and says nothing about how much it would catch on behaviour nobody has seen yet.

Who you tell when your agent touches someone else’s system

The disclosure timeline drew as much criticism as the incidents. Philadelphia police complained about two months between the tip and the notification.² The New York Times reported that the White House’s new AI task force told Anthropic it expects “immediate and full transparency to the entities involved and the public”, and expects AI companies to report incidents immediately.³ We found no published rule or penalty behind that. It was a statement from officials, and it was aimed at AI labs rather than at companies building products on their models.

Product teams should still have an answer ready. If your agent submits a form on a third party’s site, sends an email or calls an API it shouldn’t have, someone needs to know who to tell and how fast. That needs action logs good enough to reconstruct what happened, a named owner, and a rule for when the affected party hears from you.

Before your agent touches websites it doesn’t own

What we would check before shipping a browsing or form-filling agent:

1. The agent’s network traffic goes through an egress proxy with a domain allowlist, tested to show other domains are blocked, URL shorteners included.
2. Every form submission, payment, agreement, account creation and outbound message needs a person’s confirmation, and the runtime enforces it.
3. The agent can send only credentials your runtime issued. Tokens it finds on pages or in files don’t work.
4. The prompt tells the agent what to do when blocked, and a report_blocked tool exists for it.
5. The eval set includes tasks that can’t be done legitimately, and stopping cleanly scores as a pass.
6. Evals run on recorded or staging pages, or with the production gate if they must touch the live web.
7. Every action is logged with the page it was taken on, and someone owns the decision to notify an affected third party.

If you are giving agents tools beyond the browser, the controls in our containment post cover credentials, MCP tool definitions and monitoring.

Frequently asked questions