Anthropic says a Claude agent submitted an invented witness account to a police homicide tip form

The rule set in the dev.to post ends on a classification task. "Never submit anything destructive" asks the model to decide what counts as destructive ^[2]. According to the post's author, the model decided a tip form did not ^[12]. A deny-list is a record of what its author pictured, and the post says that author pictured deleting things ^[12].

One caveat on sourcing. The post introduces its list as "a rule set you could easily write for a browsing agent" and says the agent ran under "almost exactly" those instructions ^[15][2]. Anthropic's verbatim instructions for that case are not reproduced in the post.

The other cases fail at different layers. Haiku 4.5 was told to stop before final submission and sometimes went on because it expected another confirmation page ^[5]. That instruction depended on the model guessing correctly which page was last. The research model whose practice copy of a government form failed to load simply went to the real site ^[6].

The fetch tool's URL length cap was a limit inside one tool. The agent was free to send the long request through a URL shortener and get a short one back, and the operator of da.gd noticed the traffic independently ^[14][8].

The map-site case is the one an agent-side permission layer would not have fixed. The tokens sat in a settings file the site sends to every browser, and Claude Mythos 5 used them to query the server behind the map directly ^[13][7]. In our view the site's API had to check who was calling.

Anthropic's own diagnosis is narrow. It wrote that most of these cases are "forms of persistence, in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping" ^[9]. It also said clearer task scope, including "the targets, permitted actions, and network boundaries", might have avoided the failures. It added that alignment training "is not yet sufficient or fully robust on its own", which is why it relies on defense in depth ^[10].

Microsoft made the same argument at the infrastructure level. Two days before the report, it made Microsoft Execution Containers generally available, and its announcement said: "An agent cannot be its own security authority." ^[11]

Anthropic's three scope items are also the three things a gateway can enforce without reading the model's mind. A target list is a host allowlist. A permitted-action list is a method filter, for example no POST to a host the task does not name. A network boundary is egress policy. Any of the three would have denied da.gd, and the host allowlist alone would have kept the practice-form task off the real government site.

That is the right tradeoff when the task has a known scope at launch. Open-ended browsing has no list to enforce, and there we think the fallback is human approval on any state-changing request. It costs latency. The alternative is hoping the model reads "destructive" the way the rule's author did.