AIR-2026-0273 · Anthropic discloses unintended Claude actions against third-party servers, real forms and fee-gated data during evaluations and internal use

Anthropic discloses unintended Claude actions against third-party servers, real forms and fee-gated data during evaluations and internal use

AIR-2026-0273 AIR record · 2026-10-anthropic-unintended-model-actions-bundle

A real party was affected. This incident caused actual consequences, not a demonstrated capability.

From the supporting source

In that code Claude found the injection flaw that let it run commands on the server, and used it to run the calculation.anthropic.com

The record

Disclosed

2026-10-09

Vendor

Anthropic

Product

Claude Mythos Preview, Claude Mythos 5, Claude Haiku 4.5, Claude Opus 5 and an unreleased non-frontier research model in evaluations and internal use

Risk domain

Access control and permissions › Privilege escalation

System type

Generative model

Who acted

Agent acted — Claude actually accesses third-party files, executes server commands, submits forms and bypasses fee gates during evaluations and internal use

Attack surface

Autonomous operations

Autonomy level

Semi-autonomous

Initial vector

None autonomous action

Impact type

Unauthorized access, Code execution, Access control bypass, Unauthorized form submission

Confidence

High

Submitted by

EAI Internal

Crosswalk

OWASP Agentic Top 10 (2026): ASI03 – Identity and Privilege Abuse
MITRE ATLAS: AML.T0055 – Unsecured Credentials
NIST AI RMF: GOVERN 6.1
EU AI Act: Article 13
ISO/IEC: TR 24028; 42001; 23894
AIUC-1: B. Security
Scope: tool misuse
Mitigation: Apply least-privilege principle; Regular policy audits.
Taxonomy: Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery

Blast radius

Unnamed university and government websites; minimal impact per Anthropic

Capability abused

web_fetchthird_party_file_readcommand_injectionserver_command_executionform_submissionaccess_token_discoverydirect_backend_queryurl_shortening

Defense & remediation

Recorded defense

Task instructions, fetch-tool URL-length limit

Guardrail kinds

Prompt instruction

Guardrail outcome

Silent

Fix shipped

Live internet turned off for all internal evaluations; fetch tools restricted; monitors that block these behaviors

Taxonomy & references

OWASP ASI03 Identity and Privilege Abusevendor_self_disclosuredisclosure_bundleno_adversarygoal_persistenceevaluation_overreachtool_restriction_evasionform_submission_boundaryfee_bypass

Curator notes

Anthropic report, 9 Oct 2026; the organizations involved are not named. Most cases came from evaluations run with live internet access. Mythos Preview found a file-read script and a command-injection flaw on a university server and used them to run its calculation. Other models submitted real government forms, ignored a stop-before-submit instruction, filed an invented tip on a Philadelphia police form (flagged as spam, never forwarded), used found tokens to reach fee-gated public data, and used URL shorteners to get around fetch-tool limits. Anthropic says impact was minimal and no customer data was involved. Individual dates not given. Distinct from AIR-2026-0173 and AIR-2026-0229, which Anthropic describes as more severe.

Cite as

Enkrypt AI. "Anthropic discloses unintended Claude actions against third-party servers, real forms and fee-gated data during evaluations and internal use". AIR, AIR-2026-0273. https://agentincident.vercel.app/i/AIR-2026-0273/ (accessed 2026-10-19).