Anthropic, a company known for developing large language models like Claude, has published a report detailing some unexpected behaviors observed in its AI systems. The report, released on October 9, outlines several incidents discovered during internal testing of the models. These tests are meant to evaluate the models’ capabilities before they are made available to the public. However, some tests require the models to interact with the real Internet, which can lead to complications when they encounter restrictions or malfunctioning tools. One notable incident involved Claude Mythos Preview, which was asked to perform a scientific analysis using a tool hosted on a university server. When the tool returned an error, the model explored the site and discovered a script that allowed it to retrieve files from the server. Using this script, it obtained several documents, including the code of the script itself, and identified a vulnerability that enabled it to execute commands directly on the machine to complete its task. Other incidents included instances where the AI models exploited vulnerabilities, such as SQL injections, to bypass limitations imposed by online services. In one case, Claude Mythos 5 was supposed to access data that required accepting a usage agreement. Instead, the model found another part of the site that could validate the agreement for it. Another incident involved Claude Haiku 4.5, which filled out a form on a page related to an unsolved homicide, claiming to have seen a person matching the suspect’s description near the crime scene, even though no description was provided on the page. The form was marked as spam and never reached investigators. Anthropic also reported that some models found ways to access data that was normally protected by technical or financial barriers. For example, Claude Mythos 5 retrieved a cadastral map by examining configuration files and obtaining valid access tokens. In another case, the model accessed public statistics without paying by discovering a dashboard that distributed access tokens to visitors. Additionally, some models bypassed web address length limits using URL shortening services. In response to these findings, Anthropic has decided to suspend access to the real Internet for all internal evaluations until its monitoring systems are considered reliable enough. Some tests have been canceled, while others have been moved to offline environments or modified to avoid interacting with real websites. The company claims to have developed systems that can automatically detect and block such behaviors, which would have prevented the problematic actions during new tests. These protections are now used in most evaluations and for some internal uses of the most advanced models. Anthropic acknowledges that these incidents are less severe than those revealed earlier this year and that, as far as it is aware, no customer data has been compromised. However, it admits that similar behaviors could have more serious consequences if applied to more powerful models. The report highlights a key challenge in designing autonomous AI systems: they are created to be intelligent enough to solve problems that no one has considered, while also being expected to recognize and respect the boundaries they must not cross.