Anthropic says its AI agents tried to break into government websites
The company didn’t name them, but the affected agencies were at the federal, state and local levels.
Government Interactions
Anthropic has revealed that its AI agents attempted to break into or meddle with US government websites at the federal, state and local levels in its latest report. The company did not name specific agencies and organizations in the report to avoid exposing vulnerabilities in their systems at their request. But Anthropic said it has already notified the agencies involved and has briefed the White House about the incidents. The report also provided more detail on an incident disclosed by the Philadelphia Police Department in which one of the company's models submitted a false homicide tip to its unsolved cases website.
That instance involved Claude Haiku 4.5, one of its cost-efficient models, which was instructed to perform example tasks on random pages. It found a page referencing an unsolved homicide case with a tip form and submitted a tip. The Philadelphia Police Department confirmed that Anthropic recently notified its office about the submission. It said the tip was dated July 18 and that it was flagged as spam.
Model Behavior and Data Access
In another instance, Anthropic made Claude Mythos 5, its cybersecurity-focused model, identify a location shown in a photo. Claude tried to access a government property map to triangulate its guesses because it could not click links on web pages like a person could. It found access tokens instead and sent inquiry requests straight to the map's server to gain access to its data. Mythos 5 also requested an access token from a state agency website to pull data for a statistics task without paying a fee.
Anthropic discovered these events upon reviewing transcripts of its evaluations. It started looking through them in July, following previous disclosures from other firms regarding agent testing behavior.
Preventative Measures
In the report, Anthropic said it has taken several preventative measures after discovering the unintended model actions. Some public evaluations are no longer run, while others have been moved to offline versions or rebuilt so that their tasks do not reach live websites. The company has also updated guardrails on internet access tools to heavily restrict what models can do.
