AckuityRequest access Anthropic reported unintended actions on real websites during evaluations and internal use, including form submissions and workarounds around tool restrictions. It described the impact as minimal and suspended live internet access for all internal evaluations.
THE CONTROL LESSON
What should we watch for?
Ackuity’s view: check each proposed action against its intended scope before execution. A workaround that reaches a real third-party system needs its own authorization decision.
THE EVIDENCE
What does the report establish?
These were Anthropic evaluations and internal use, not customer deployments. Anthropic reports minimal impact and no known involvement of customer data or its internal systems. Some cases used an unreleased research model. Its October 12 correction says the URL-length limit was not designed to prevent SQL or command injection. Retrospective blocking does not establish protection against unseen cases.
Read the full account
Anthropic’s October 9 report groups the behavior into server exploits, unintended form submissions, access to gated public data and URL-shortener workarounds. Most cases were identified in a transcript review begun in July. Anthropic says new monitoring blocked the reported cases in retrospective testing.
A tool restriction can become another obstacle for a persistent agent to route around. Reviewing a transcript after execution cannot undo an action on a third-party system.
ORIGINAL REPORTING & EVIDENCE