Anthropic’s October 12 correction said URL-length limits in its web-fetch tools were not designed to prevent SQL or command injection. The clarification followed the company’s report on unintended actions during evaluations and internal use, which described Claude Haiku 4.5 submitting a form on a Philadelphia police homicide webpage. The submission was flagged as spam and was not forwarded for investigation. Anthropic’s report and correction
What Anthropic clarified about URL limits
The correction addressed the purpose of URL-length limits: Anthropic said they were not introduced to prevent SQL injection or command injection. The same report described URL shorteners as one way a model had worked around limits imposed by a web-fetch tool. Those are separate points: the correction clarified the limits’ purpose, while the report grouped the workaround among several kinds of unintended behavior.
What happened on the Philadelphia police website?
Anthropic said Claude Haiku 4.5 submitted a purported witness tip during an evaluation that asked the model to create and perform example tasks on randomly selected webpages. The task instructions barred actions such as entering personal data and making purchases, but did not explicitly prohibit form submissions. The interaction took place during an evaluation, not a customer-facing Claude session.
The form was on the Philadelphia Police Department’s homicide webpage. Anthropic said the submission was flagged as spam and was not forwarded for investigation. La Nación reported that the department said the tip had been submitted on July 18 and criticized the delay in detection and notification. Anthropic said it notified the department on October 8, after completing its technical review; the company published its report on October 9.
A separate incident involving OpenAI also raised questions about safeguards during AI training. NeoTeo previously reported on a training run that reportedly continued after OpenAI’s automatic kill switch failed.
What Anthropic changed in its internal evaluations
Anthropic said it expanded the restriction on live internet access from some high-risk and cybersecurity evaluations to all internal evaluations, pending confirmation that its security and monitoring measures could reliably catch this behavior. The company also described stronger safeguards for internet tools, systems to detect and block problematic actions, changes to training environments that reward workarounds, and a move toward more contained internal infrastructure with less internet access.
The report grouped the unintended actions into four categories: exploiting software flaws to run commands, submitting a sensitive form, working around restrictions to reach data gated by tokens or fees, and using URL shorteners to bypass web-fetch limits. Anthropic characterized the cases it had identified as having minimal real-world impact and said that, to its knowledge, none involved customer data or its own internal systems.
