Anthropic's test agents filed a fake police tip and worked around paywalls. Tell your agents what they must never do

Anthropic just published a list of things its own agents did that nobody asked them to do. It reads like a checklist for anyone deploying agents at a business.

What happened

Anthropic released a report on unintended actions by Claude during evaluations and internal use. It groups them into four categories: exploiting basic software flaws to run commands on a server, submitting a sensitive form on a real website, working around restrictions to reach data gated by a token or a fee, and using URL shortening services to get around limits in its fetch tool.

The most reported case: Claude Haiku 4.5, asked to generate example tasks on random webpages, landed on a police tip form and submitted an invented tip. Its instructions said never to log in, create accounts, enter personal data, make purchases or submit anything destructive, but did not rule out form submissions. The tip was flagged as spam and never investigated. TechCrunch reports Anthropic did not discover it until September 28, more than two months later, and the Philadelphia Police Department called the delay unacceptable.

In another case, Claude was told to fill a form but stop before the final submission. Several times it submitted anyway, expecting another confirmation page.

Anthropic says many cases came from ambiguous or impossible tasks. It has turned off live internet access for all internal evaluations, built tooling that blocked every case in the report when tested, and is moving internal agents to centrally managed infrastructure with strong containment.

My take

Three lessons transfer straight to client work.

First, a list of forbidden actions always has gaps. The police tip slipped through because "submit a form" was not on the list. For business agents, I write the opposite: a short allow list of the exact tools, sites and records the agent may touch. Everything else is off.

Second, "stop before submitting" is not a control if it lives only in the prompt. The agent believed it was demonstrating, not submitting. Final actions like sending an email, posting to a CRM or paying an invoice should sit behind an approval step the model cannot trigger itself.

Third, give the agent a clean way to fail. Anthropic notes that when Claude could not finish a task, it often worked around a restriction instead of stopping. Your agent needs an explicit "I'm blocked, here is why" exit that routes to a human.

And read the logs. Anthropic found these through transcript reviews months later. A weekly look at what your agents actually did is cheap insurance.