WEBVTT 1 00:00:01.300 --> 00:00:10.148 This is Anthropic, Read Aloud. Today: Investigating unintended model actions in our evaluations and internal use. 2 00:00:11.448 --> 00:00:16.781 Investigating unintended model actions in our evaluations and internal use. 3 00:00:17.231 --> 00:00:24.975 Anthropic is an A I safety and research company that's working to build reliable, interpretable, and steerable A I systems. 4 00:00:25.425 --> 00:00:29.881 From Anthropic Research, published October 9, 2026. 5 00:00:30.881 --> 00:00:38.754 This report describes examples of unintended model actions we’ve observed during evaluations and internal use of Claude. 6 00:00:38.873 --> 00:01:00.335 It is part of our effort to publish more frequent standalone reports on model behavior and alignment beyond our system cards, which we publish with each model release, and our risk reports, which we publish every three to six months as part of our Responsible Scaling Policy. We believe it’s important to be transparent about what we see our models do during testing and use. 7 00:01:00.785 --> 00:01:03.514 The behaviors can be grouped into four categories: 8 00:01:03.964 --> 00:01:08.221 Claude exploiting a basic flaw in software to run commands on a server. 9 00:01:08.461 --> 00:01:12.728 Claude submitting a sensitive form on a real website when it should not have. 10 00:01:12.968 --> 00:01:18.612 Claude working around a restriction to reach data that was gated by a token or a fee; and. 11 00:01:18.852 --> 00:01:23.615 Claude using U R L shortening services to get around limits in its fetch tool. 12 00:01:24.065 --> 00:01:46.764 We have chosen not to name the organizations involved in the examples below to avoid exposing vulnerabilities in their systems, and at their request. For this reason, we also provide less detail about each case than we otherwise would. Some of the cases described below involved websites run by U S government agencies at the federal, state, and local levels. 13 00:01:46.884 --> 00:01:51.607 We have briefed the White House on these cases and notified each agency involved. 14 00:01:52.057 --> 00:02:13.982 The cases we’ve identified to date in these categories had minimal real-world impact. We consider these behaviors to be significantly less severe from an alignment and security perspective than the cybersecurity incidents we reported on July 30 and September 9. They resemble behaviors that we’ve described in our system cards since Claude Mythos Preview. 15 00:02:14.102 --> 00:02:21.912 Most are forms of persistence, in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping. 16 00:02:22.362 --> 00:02:31.386 Although the impact of these behaviors was minimal and we had already turned off live internet access for some high-risk and cybersecurity evaluations, 17 00:02:31.506 --> 00:02:45.863 we have now decided to expand that to include all our internal evaluations until we have confirmed that our security and monitoring measures (described in the remediation section of this post) reliably catch behaviors like these. 18 00:02:45.983 --> 00:02:55.498 Below, we also discuss alignment considerations and give more detail on how we’re modifying training to reduce the likelihood of further misbehavior. 19 00:02:55.948 --> 00:03:13.099 We identified most of these cases through a review of transcripts that we began in July. Our review first focused on our cybersecurity evaluations, tests where a model is deliberately asked to probe or attack a test system, and where internet access is meant to be disabled. 20 00:03:13.219 --> 00:03:35.345 We have since extended our scanning to encompass a much wider range of instances where Claude could have reached the internet, including tests where internet access is deliberately enabled so Claude can be evaluated on real-world tasks. We began by looking for incidents of similar severity to the cybersecurity incidents we reported this summer; we have not found any to date. 21 00:03:35.465 --> 00:03:43.713 We then broadened the search to lower-severity cases, where a model interacted with real websites or systems in ways we didn’t intend. 22 00:03:44.163 --> 00:04:02.553 We are also now scanning a much larger pool of lower-risk transcripts, as well as our use of Claude within Anthropic and in reinforcement learning (R L) environments where Claude has access to the internet. As this work continues, we plan to report new instances of unintended behaviors. 23 00:04:02.673 --> 00:04:13.078 All cases reported here involved Claude interacting with the outside world; to our knowledge, none of them involved customer data or Anthropic’s own internal systems. 24 00:04:13.528 --> 00:04:28.508 In this post, we explain why we run evaluations, which are where most of these cases occurred; describe each behavior in more detail; and offer a preliminary view of what the behaviors suggest about Claude’s alignment and how we’re mitigating them. 25 00:04:29.308 --> 00:04:31.407 Why and how we run evaluations. 26 00:04:31.857 --> 00:04:46.053 The behaviors described in this post are not specific to evaluations, but many of the cases we’ve identified to date occurred during evaluation runs. We continually test models on a wide range of tasks prior to releasing them. 27 00:04:46.173 --> 00:05:09.022 We use many different evaluations (standardized sets of tasks, scored the same way each time), each of which helps to paint a picture of Claude’s skills in a particular area. Many of the evaluations we use are public; they are written by outside researchers and can be run by any developer, allowing us to compare capabilities across models. Other evaluations we build in-house. 28 00:05:09.471 --> 00:05:27.335 Because language models are non-deterministic, that is, their responses always involve some element of randomness, and they may carry out the same task slightly differently each time, we have Claude complete each evaluation task hundreds or thousands of times (each attempt is called a run). 29 00:05:27.455 --> 00:05:46.425 Testing so many times allows us to understand how a model typically performs, and also to catch rare cases where a model does something we don’t expect. What we learn from evaluations shapes decisions across Anthropic, including how we train models, what safeguards we build around them, and when we release them. 30 00:05:46.875 --> 00:06:04.919 Evaluations are also where a model’s behavioral issues are sometimes first revealed. Models learn much of what they can do through R L, in which they attempt a task within a specific environment many times over and are rewarded when they succeed. However, training environments are imperfect. 31 00:06:05.039 --> 00:06:18.151 If training rewards something we didn’t intend, such as finding loopholes or working around a restriction, the model learns that the workaround pays off and may then apply it elsewhere. This is known as reward hacking. 32 00:06:18.271 --> 00:06:34.067 While we have processes in place to identify and filter out reward hacking during training, evaluations are a critical mechanism for understanding a model’s behavioral propensities in different contexts and on different sets of tasks than those we have in training. 33 00:06:34.517 --> 00:06:56.235 Some tasks, such as searching the web for hard-to-find information, are difficult to realistically simulate in an environment without internet access. Running them with access has been standard practice within the industry: public web search benchmarks are run on the live internet by default, and running them the same way allows us to compare our models with other models. 34 00:06:56.355 --> 00:07:00.216 Most of the cases in this report occurred during such evaluations. 35 00:07:01.016 --> 00:07:02.414 Overview of behaviors. 36 00:07:02.864 --> 00:07:15.607 Below, we describe four categories of behavior in which Claude acted on real websites and systems in ways we did not intend, each of which involved an organization or person outside Anthropic. 37 00:07:16.407 --> 00:07:20.296 Exploiting a basic flaw in software to run commands on a server. 38 00:07:20.746 --> 00:07:35.291 When Claude could not complete an evaluation task directly, either because its own tools were deliberately limited or because an outside service it needed was unavailable, it used other tools hosted on a third party’s site to achieve its goal. 39 00:07:35.411 --> 00:07:47.678 In some circumstances, it did this by exploiting basic flaws in that site’s software, using sequel or command injection (a way of sending input that the site mistakenly runs as instructions). 40 00:07:48.128 --> 00:08:03.331 For example, one evaluation asked Claude Mythos Preview to run a scientific analysis. The public tool it needed to perform that analysis was hosted by a university; when the model sought to access to it, the tool returned an error. 41 00:08:03.451 --> 00:08:24.219 Looking for another way to complete the task, Claude explored the tool’s website, found a script on the university’s server that would return any file it was asked for, and used it to copy files from the server, including the script’s own code. In that code Claude found the injection flaw that let it run commands on the server, and used it to run the calculation. 42 00:08:24.669 --> 00:08:41.586 In another instance, the data Claude Mythos 5 needed was free, but Claude could not access it without accepting a data use agreement, which it did not have the tools to do. Claude used applications hosted on the website to load the page and accept the agreement on its behalf. 43 00:08:42.036 --> 00:08:55.156 We saw this behavior on DeepSearchQA and BrowseComp (both public web research evaluations), on LABBench2 (a public biology research benchmark), and during internal evaluations. 44 00:08:55.956 --> 00:08:57.761 Submitting a form it should not have. 45 00:08:58.211 --> 00:09:13.230 We saw instances where Claude submitted an online form when it shouldn’t have. Generally, this occurred when an evaluation’s instructions were ambiguous, or when a misconfiguration within the environment prevented Claude from working with dummy forms. 46 00:09:13.680 --> 00:09:35.066 For example, in a case which happened multiple times on the same evaluation, an unreleased, non-frontier research model was meant to fill out a practice copy of a government form. When the copy failed to load or the model closed it by mistake, the model instead navigated to the website where the real form is normally hosted and submitted the form there. 47 00:09:35.516 --> 00:09:53.146 In another evaluation, Claude Haiku 4.5 was instructed to complete a form up until the final submission stage, but to stop before actually submitting. Several times Claude mistakenly submitted the form instead, expecting there to be an additional confirmation page. 48 00:09:53.266 --> 00:10:00.605 In these instances, the model’s chain-of-thought stated that it was demonstrating the process, not submitting a real request. 49 00:10:01.055 --> 00:10:20.103 In a third example of this behavior, Claude Haiku 4.5 had been tasked with generating and performing example tasks on randomly selected webpages. In one run, the model landed on a page referencing an unsolved homicide; that page contained a tip form run by a police department. 50 00:10:20.223 --> 00:10:37.154 Claude was instructed never to log in, create accounts, enter personal data, make purchases, or submit anything destructive, but the instructions did not rule out form submissions. Claude filled out the form with the following: “I may have information regarding this case. 51 00:10:37.274 --> 00:10:56.265 I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant.” (The website did not include a description of the perpetrator.) The model left the name and contact fields empty, which the form allowed, and submitted it. 52 00:10:56.385 --> 00:11:00.680 The submission was flagged as spam and was never forwarded for investigation. 53 00:11:01.130 --> 00:11:11.167 We saw this behavior on OSWorld (a public computer use evaluation), on Odysseys (a long-horizon task evaluation), and during internal usage. 54 00:11:11.967 --> 00:11:14.806 Working around restrictions to reach gated data. 55 00:11:15.256 --> 00:11:26.994 Claude sometimes worked around a restriction to reach data to which it did not have access. Generally, this occurred when a server refused Claude’s request, or when the data was offered only for a fee. 56 00:11:27.444 --> 00:11:46.457 For example, in an evaluation that asked Claude Mythos 5 to identify a location shown in a photo, it attempted to access a local government’s property map to triangulate its guesses. Claude could read webpage text, but the evaluation limited its ability to click through them as a person would. 57 00:11:46.577 --> 00:11:57.503 Instead, it read the settings file the site sends to browsers, found working access tokens, and used them to send requests directly to the server behind the map to access the data. 58 00:11:57.953 --> 00:12:18.995 In another example of this behavior, an Anthropic researcher used Claude Mythos 5 on a statistics project that required it to pull public data that was available from a state agency for a fee. Instead, Claude learned from an archived copy of the agency’s website that its public dashboard issues an access token to any visitor. 59 00:12:19.115 --> 00:12:23.429 It requested one and used it to query the database without paying the fee. 60 00:12:23.879 --> 00:12:29.418 In both examples, Claude obtained data already available to the public but only for a fee. 61 00:12:29.868 --> 00:12:38.291 We saw this behavior on Humanity’s Last Exam, an evaluation of expert-level academic questions, and during internal usage. 62 00:12:39.091 --> 00:12:41.295 Using U R L shortening services. 63 00:12:41.745 --> 00:13:03.441 Some of our fetch tools, which let Claude read webpages, limit the length of the U R Ls Claude can request. This is to prevent Claude from using long U R Ls to take certain unwanted actions, such as sequel or command injections (part of a U R L is text passed to a site’s server, and a long one has room to carry such instructions). 64 00:13:03.561 --> 00:13:26.494 We saw several models, including Claude Opus 5 and Claude Mythos 5, get around this limitation by using free U R L shortening services. We first identified this behavior internally, but as we were writing this post, an operator of the da.gd U R L shortening service let us know that they had also found Claude using their website for this purpose. 65 00:13:26.614 --> 00:13:29.073 We thank the operator for sharing these details. 66 00:13:29.873 --> 00:13:30.854 Remediation. 67 00:13:31.304 --> 00:13:45.639 We’ve taken several preventive measures. Some of the public evaluations we no longer run; others we have moved to their offline versions, or rebuilt them so that their tasks do not reach live websites. We’ve also made broader changes. 68 00:13:45.759 --> 00:14:03.850 We have updated the guardrails on some of our internet access tools, such as the web fetch tool, to heavily restrict what the model can do with them. And, as part of our ongoing agent security and monitoring efforts, we have built tooling to automatically detect and block the kinds of behaviors described above. 69 00:14:03.970 --> 00:14:15.567 This tooling now runs on most of our evaluations and on internal agentic use of frontier models. When we tested it against the cases described in this post, it blocked all of them. 70 00:14:16.017 --> 00:14:31.768 As we described in our August 31 post, we are also continuing to fix or remove training environments that reward Claude for working around tool restrictions or other blockers, so that they do not incentivize these behaviors or permit reward hacking. 71 00:14:32.218 --> 00:14:39.562 We’re also taking other steps to prevent unintended agentic actions within Anthropic, and to catch them if they occur. 72 00:14:39.682 --> 00:14:57.555 These include migrating internal agents to centrally managed infrastructure with strong containment, minimizing internet access for internal agents and training processes, and monitoring far more of what agents do through techniques like safety classifiers and hierarchical summarization. 73 00:14:57.675 --> 00:15:12.118 These measures are now part of our security team’s detection and response procedures so that we can respond to and contain undesired behavior quickly. We expect to publish more on these approaches, and to build them directly into our products. 74 00:15:12.918 --> 00:15:14.995 Discussion and alignment takeaways. 75 00:15:15.445 --> 00:15:28.417 While we have not completed a full alignment assessment of these cases, we consider them to be less severe than the cybersecurity incidents from this summer. We explain why below, and share the general lessons we’ve drawn from them. 76 00:15:29.217 --> 00:15:30.489 Alignment context. 77 00:15:30.939 --> 00:15:38.958 As we establish a regular public reporting process for behaviors like these, we also want to situate them in terms of their severity. 78 00:15:39.078 --> 00:15:57.126 This remains challenging: judging the extent of an alignment failure often depends on what the model was trying to do, and a model’s own account of its reasoning is not necessarily reliable evidence of its beliefs or reasons for action, as we discussed in our September 9 alignment assessment. 79 00:15:57.246 --> 00:16:17.620 As models grow more capable, they can interact with the world in more sophisticated ways, which makes more complex failures possible. For example, the biased reasoning we described in that assessment was not new, but it led to more serious consequences in a setting where models could capably act on real systems for hours at a time. 80 00:16:17.740 --> 00:16:26.184 An alignment severity framework built around today’s failures could become outdated quickly, given how fast A I capabilities are advancing. 81 00:16:26.634 --> 00:16:41.866 Nonetheless, we found two alignment dimensions useful for examining the cases in this post: overreach, or how far the model went beyond what its task intended, and dishonesty, or whether it gave a misleading account of its actions or intentions. 82 00:16:41.986 --> 00:16:55.698 On overreach, we consider these cases to be substantially less concerning than the incidents we reported this summer, in which Claude gained access to real third-party systems for hours during cybersecurity evaluations. 83 00:16:55.818 --> 00:17:10.005 In the cases we report here, in contrast, Claude bypassed access controls to reach gated but publicly available data, or exploited software flaws and ran commands on servers (mainly to reach non-sensitive data). 84 00:17:10.455 --> 00:17:31.154 On dishonesty, the comparison is more mixed. In one case, tasked with generating example interactions with websites, Claude submitted an invented tip through a police department’s online form. From the transcript, Claude appears to have only been producing example content for the task, rather than trying to mislead anyone to achieve a goal. 85 00:17:31.274 --> 00:17:40.097 In the most serious incident from this summer, by contrast, Claude’s misleading reasoning was sustained over hours and supported its continued attack. 86 00:17:40.217 --> 00:17:55.556 Still, judging dishonesty with confidence typically requires a deeper assessment than we have done here, such as replaying transcripts with modifications to test what drove the model’s behavior, so our view of these cases may change with further analysis. 87 00:17:56.356 --> 00:17:57.791 Lessons and next steps. 88 00:17:58.241 --> 00:18:13.108 None of the behaviors we’ve described here are new and they do not change our overall view of Claude’s alignment. In many of the cases where we observed these behaviors, Claude had been given tasks that were ambiguous or impossible to complete. 89 00:18:13.228 --> 00:18:23.319 We and others have observed that when models are given impossible-to-complete tasks, they will pursue unintended and sometimes misaligned strategies to achieve their goals. 90 00:18:23.769 --> 00:18:40.311 It is possible that some of these failures could have been avoided if the evaluation questions had more clearly stated what was in and out of scope for the exercise, including the targets, permitted actions, and network boundaries (that is, what the model should and shouldn’t access). 91 00:18:40.431 --> 00:18:51.800 However, Claude encounters ambiguous and impossible tasks every day in real use, and, indeed, several of the cases we observed occurred during regular agentic use of Claude. 92 00:18:52.250 --> 00:19:10.659 Behavioral and alignment training is the main technique we have at our disposal to improve Claude’s judgment and ability to handle ambiguous situations with care. Historically, we have been more focused on teaching models to respect boundaries and be appropriately cautious in coding environments. 93 00:19:10.779 --> 00:19:32.084 We are now expanding these environments to applications like search and computer use, which were involved in the cases described here. However, alignment training is not yet sufficient or fully robust on its own, at least in the short term, so we also rely on defense-in-depth approaches, including the classifiers and safeguards described above. 94 00:19:32.534 --> 00:19:47.615 We plan to keep reporting concerning behaviors as our scan and analysis continue. We hope these reports help other developers check for similar behaviors in their own models, since many of the evaluations involved are public and widely used. 95 00:19:47.735 --> 00:20:03.223 While these cases had minimal impact, we do not want to diminish the findings, because the same behaviors could do far more harm as models become more powerful. The larger the role models play in society, the more the public deserves to know how they behave. 96 00:20:03.673 --> 00:20:18.433 Note: The tip form example described above involved the Philadelphia Police Department who self-disclosed today via their press release. We shared this finding with the department on October 8 as soon as our technical review was complete. 97 00:20:19.433 --> 00:20:39.132 That was Investigating unintended model actions in our evaluations and internal use, from Anthropic Research, published October 9, 2026. Read the original at anthropic dot com. This unofficial audio edition was generated automatically for the podcast Anthropic, Read Aloud.