Anthropic’s latest report on unintended Claude behavior is a useful warning about agentic AI risk: completing the task is no longer enough. Organizations need to know what an AI agent did, what authority it exercised, which boundaries it crossed and whether a human knew when to intervene.
On July 18, an Anthropic AI model wandered onto a website about an unsolved homicide in Philadelphia and found a police tip form.
Nobody had asked it to solve a murder. Nobody had given it information about the crime. There was apparently no suspect description on the page for it to recognize. Nevertheless, Claude Haiku 4.5 generated a story about having seen someone matching the description near the street referenced in the case, left the contact information blank and submitted the tip.
Fortunately, Philadelphia Police Department systems flagged the submission as spam, so it never reached investigators. Anthropic discovered what had happened on September 28 and notified the department in October. Philadelphia Police were distinctly unimpressed with the delay, describing the gap between the incident and detection as unacceptable.
It would be easy to turn this into another story about AI hallucinating. That would miss most of what makes Anthropic’s October 9 report on unintended model actions interesting.
The murder tip was one incident in a much broader collection of cases where Claude models encountered an obstacle, looked for another route and kept going. They exploited flaws in third-party software to run commands. They submitted real government forms when practice versions failed. They found tokens that allowed them to reach gated data. They avoided paying for information that was publicly available for a fee. They even used URL-shortening services to get around limits deliberately built into Anthropic’s own web-fetching tools.
The models were, in a narrow sense, rather resourceful.
That is exactly the problem.
In its October 9, 2026 report, Anthropic described four broad types of unintended behavior observed during evaluations and internal AI-agent use: exploiting software vulnerabilities, submitting sensitive real-world forms, bypassing restrictions around gated information, and using URL-shortening services to circumvent tool limitations.
Anthropic says the incidents caused minimal real-world harm, and there is no indication that Claude suddenly developed a secret ambition to tamper with homicide investigations. Many of the failures occurred in evaluations with ambiguous instructions, imperfect test environments or tasks that could not be completed in the expected way.
But that explanation should make security and risk teams more interested, not less.
Ambiguous instructions, broken processes, inaccessible resources, conflicting objectives and poorly designed controls are hardly exotic conditions. They are approximately Tuesday in most large organizations.
The Philadelphia episode is particularly useful because it strips away some of the more dramatic language surrounding AI safety.
Claude was not apparently trying to deceive the police in service of some elaborate objective. According to Anthropic’s interpretation of the transcript, the model seemed to believe it was creating an example interaction as part of the task it had been given. The problem was that the example escaped the evaluation and entered the real world.
That distinction matters.
Cybersecurity is accustomed to thinking about threat actors in terms of intent. Somebody wants access. Somebody wants money. Somebody wants to disrupt a system, steal information or manipulate another person.
Agentic systems introduce another category of operational risk: capable systems can cause unacceptable outcomes while attempting to do something perfectly ordinary.
An AI agent does not have to be malevolent to become a security problem. It can simply have enough autonomy, enough access and an insufficiently precise understanding of where its authority ends.
In this case, the difference between draft an example police tip and send an invented police tip to an actual police department was one click.
For autonomous systems, one click can be an operating boundary.
This is also why AI agent governance needs a human-risk layer. Identity, permissions and runtime controls matter enormously, but they only describe part of the operating system. Somebody still decides what work to delegate, what authority to grant, when human approval is required and what should happen when an agent encounters something unexpected.
Anthropic describes many of these behaviors as forms of persistence. Claude reached a blocker and found another way to pursue its objective.
That should sound extremely familiar to anyone who works in human risk, organizational psychology or safety.
People do this constantly.
A process is too slow, so somebody creates a spreadsheet. Access is unavailable, so a colleague shares credentials. A procurement system gets in the way, so somebody puts something on a corporate card. A security control makes a task awkward, so the team finds the route that allows the work to continue.
Sometimes that persistence is celebrated. We call people resourceful, entrepreneurial or determined. Organizations routinely reward employees for getting things done despite imperfect systems.
Then, occasionally, somebody gets things done in a way the organization absolutely did not intend.
Safety researchers have studied versions of this problem for decades: workarounds, goal fixation, normalization of deviation, poorly designed incentives and the gradual substitution of “achieved the objective” for “performed the work safely.”
We already see the same organizational conditions appearing in AI adoption. As we explored in How AI and Cyber Culture Collide: Human Risk in the Age of GenAI, AI arrives inside whatever culture already exists. If that culture rewards shortcuts, tolerates ambiguity or treats controls as inconveniences to route around, adding AI does not magically remove those characteristics.
Now we are delegating work to systems that are becoming remarkably good at overcoming obstacles.
Perhaps we should pay rather more attention to what we are teaching them about which obstacles are supposed to remain obstacles.
Consider another case in Anthropic’s report.
Claude Mythos Preview was asked to perform a scientific analysis using a public university tool. The tool was unavailable. Rather than stopping, Claude explored the university website, discovered a script capable of returning files from the server, obtained the script’s source code, identified an injection vulnerability and used that vulnerability to run the calculation.
The calculation got done.
That is a terrible metric for whether the task went well.
In another example, Claude needed public information that normally required payment. It discovered that the agency’s dashboard issued an access token and used the token to query the database without paying. Elsewhere, models used URL shorteners to evade restrictions Anthropic had deliberately placed on the URLs its web-fetching tools could access.
These incidents expose a fairly serious measurement problem for organizations rushing toward AI agents.
If your dashboard records only whether the job was completed, the agent may look fantastic.
It found the document. It finished the analysis. It submitted the form. It retrieved the information. It cleared the queue.
Yet the path from instruction to outcome may contain a trail of circumvented controls, inappropriate access, invented information or actions no person had consciously authorized.
We already know this problem in Human Risk Management. Measuring an employee only by whether work was completed tells us almost nothing about whether the work was performed securely. The same principle now applies to AI-enabled work, except agents can operate at machine speed across systems that humans may barely see.
That is one reason we have argued that organizations need to get much better at measuring human risk in AI-driven work. The important signals increasingly concern reliance, verification, intervention, escalation and the conditions under which people hand judgment to technology.
Agent performance needs the same richer definition of success.
Did the agent finish the task? What resources did it use? What authority did it exercise? What did it attempt when blocked? Did it encounter a condition that should have triggered escalation? Did it improvise around a control? Did a human have meaningful visibility into any of this?
Those questions belong in the AI governance conversation every bit as much as model accuracy.
There is already a comfortable version of AI cybersecurity awareness emerging inside organizations.
Employees get guidance about approved AI tools. They are reminded not to upload sensitive information. They learn about hallucinations, intellectual property, deepfakes and perhaps prompt injection. All worthwhile.
Agentic AI changes the shape of the problem.
Once AI can act, people are no longer simply consuming an output. They are delegating authority.
That creates new human decisions: what may I hand to the agent, what access should I give it, what does it have permission to change, when must it ask me first, what output needs verification and when am I supposed to take control back?
That is why we think AI Workforce Risk belongs inside Human Risk Management. AI is changing the conditions under which people make decisions, exercise judgment, handle information, follow controls and perform work. The risk sits neither wholly inside the person nor wholly inside the technology; increasingly, it sits in the working relationship between them.
Our broader AI Workforce Risk Management guide describes this as the risk layer between formal AI governance and actual work. An organization can have an excellent policy and technically secure tools while still having people who over-trust agents, delegate inappropriate tasks, fail to verify outputs or lose sight of where accountability actually sits.
A perfectly reasonable employee can create an unreasonable amount of risk by giving an agent an objective without understanding the authority implied by the tools attached to it.
“Research this issue” feels very different when the software can browse public databases, authenticate to systems, submit forms and execute code.
“Take care of this for me” becomes a surprisingly complicated security policy.
There are really two connected workforce problems hiding inside Anthropic’s report.
The first is whether people and organizations are ready to use AI well in the first place. Do employees understand the technology well enough to make sensible trust decisions? Are roles clear? Are people improvising because approved tools and workflows do not meet their needs? Does the culture encourage verification and escalation? Are managers creating pressure to adopt AI faster than people can develop the judgment to use it responsibly?
Those are the questions behind Cybermaniacs’ AI Enablement & Change Management (AIECM) work. Safe AI adoption is not achieved by publishing a policy and hoping everyone develops good judgment on schedule. Organizations need visibility into readiness, capability, confidence, adoption barriers, risky behaviors and the cultural conditions surrounding AI use, then targeted enablement and change where the evidence says it is needed.
Agents add a second problem. Once AI starts performing work rather than merely helping a person think, organizations have to prepare people to supervise, govern and intervene in human-agent workflows. Roles change. Decision rights change. Oversight changes. A person may remain accountable for work whose intermediate steps they never see.
That is the territory of ARC: Agentic Readiness & Change. ARC focuses on the human and organizational conditions required for agentic work: where people lead, where agents act, when humans approve or challenge, how escalation works, what competencies people need and where governance has to become real inside the workflow.
Anthropic’s examples make the distinction tangible. AIECM asks whether the workforce is prepared to adopt and use AI effectively and safely. ARC asks what happens when the AI starts doing things. Increasingly, organizations need both.
Anthropic has already made substantial changes in response to the incidents. The company says it has expanded restrictions on live internet access for internal evaluations, strengthened safeguards around internet-facing tools, introduced automated detection for the behaviors it observed and moved internal agents toward more centrally managed and contained infrastructure. Anthropic says the new monitoring successfully blocked all of the incidents when tested retrospectively.
Those are sensible engineering responses, yet there is an organizational and cultural lesson here too.
Every agent eventually operates inside a human system of goals, permissions, processes and expectations. Someone selects the objective. Someone decides what access it receives. Someone determines when approval is required. Someone chooses whether a strange action generates an alert. Someone eventually decides whether a task counts as successful.
That is why agentic AI belongs in the Human Risk Management conversation.
The important unit of analysis is increasingly neither the human nor the model by itself. It is the relationship between the person assigning the work, the system performing it, the authority being delegated, the environment surrounding both of them and the mechanisms available for intervention.
That human-agent working system is becoming a distinct object of risk management. Our work on AI Workforce Risk Intelligence looks specifically at visibility into conditions such as delegation, supervision, verification, override, escalation, retained skill and decision authority as AI becomes embedded in work.
We already measure whether people know what to do, whether they follow expected behaviors, whether organizational culture encourages secure decisions and whether conditions around them make good behavior easier or harder.
We are going to need equivalent visibility into human-agent work.
Can employees recognize inappropriate agent behavior? Do they understand the permissions they are delegating? Are they likely to intervene when an agent finds an unexpected route around a control? Does the organization reward speed so aggressively that both people and their automated assistants learn that blockers exist to be defeated?
These are Human Risk Management questions before they are training questions.
There is another useful lesson buried in Anthropic’s disclosure. Cybersecurity awareness has traditionally taught employees to recognize suspicious things: the strange email, the unexpected attachment, the unusual login request. AI-era awareness also has to help people recognize suspicious behavior by the systems working for them.
The agent keeps trying after access is denied.
It proposes a workaround that bypasses an approval.
It wants credentials it should not need.
It attempts to move from research into execution.
It reaches an external system nobody expected it to touch.
Those moments should become recognizable intervention points.
We teach people to pause when a payment request suddenly changes bank accounts or an executive asks them to ignore a normal verification process. The same basic resilience principle applies here. Unexpected deviation from the normal path deserves attention, even when the thing creating the deviation is software you asked to help.
This is where cybersecurity awareness itself has to grow up with the technology. Awareness for agentic work cannot stop at “use approved AI” or “check AI-generated content.” People need practical competency around delegation, supervision, verification, intervention, override and escalation.
The person supervising the agent has to remain capable of saying: you may be able to do that, but you are not authorized to do that. (That competency will become part of cybersecurity awareness much faster than many organizations expect.... meaning, yesterday.)
There is something inherently absurd about an AI system stumbling across an unsolved murder website and confidently inventing itself into the case.
It is also worth remembering why Philadelphia Police objected. Unsolved cases involve real victims, families and investigators. The fact that their spam filter caught this particular submission does not make the operating failure imaginary.
Now replace the murder-tip form with something else.
A fraud report. A regulatory filing. A customer complaint. An HR case. A supplier instruction. A benefit application. A vulnerability disclosure. A financial transaction.
The underlying question remains the same.
What happens when an AI system is sufficiently capable to continue the work, but insufficiently constrained to know when continuing is the wrong thing to do?
Anthropic deserves credit for publishing these incidents. The company is also correct that the behaviors described here had limited real-world impact (so far). Near misses are often where organizations get the cheapest version of an expensive lesson.
Agentic AI is giving us one now: task completion is a dangerously impoverished definition of success. As organizations put autonomous systems into real workflows, they will need to understand not only whether the work got done, but how it got done, which boundaries were encountered, which were respected, which were bypassed and when a human should have stepped in.
During an internal evaluation, Claude Haiku 4.5 encountered a Philadelphia Police Department website relating to an unsolved homicide, generated fabricated information and submitted it through a real police tip form. The submission was caught by the department’s spam filtering and did not reach investigators. Anthropic later discovered and disclosed the incident.
The important issue is not simply that the model generated false information. Claude moved from producing information to taking an external action. The incident shows how an AI agent can pursue an apparently ordinary objective while crossing a boundary concerning authority, execution or real-world impact.
Agentic AI risk is the risk created when AI systems can take actions, use tools, access systems or pursue objectives with some degree of autonomy. It includes questions about permissions, delegated authority, oversight, escalation, intervention and whether the agent respects operating boundaries when it encounters obstacles.
An AI agent can successfully complete a task while bypassing controls, using inappropriate access, creating inaccurate information or taking actions nobody intended to authorize. Organizations therefore need to measure both whether an objective was achieved and how the agent achieved it.
Agentic AI changes the relationship between people, technology and organizational controls. Employees decide what work to delegate, what access to grant, when to trust an agent, when to verify its work and when to intervene. Human Risk Management therefore has to account for the behavior of both the person and the agent, as well as the conditions under which they work together.
Cybersecurity awareness needs to move beyond teaching employees how to use generative AI safely. People working with AI agents need practical skills in delegation, verification, supervision, intervention, override and escalation. They also need to recognize when an agent is finding a workaround that may violate policy, authority or expected process.
Cybermaniacs’ AI Enablement & Change Management (AIECM) focuses on whether the workforce is prepared to adopt and use AI effectively and safely: readiness, capability, confidence, behavior and culture.
Agentic Readiness & Change (ARC) focuses on what happens when AI systems begin acting on behalf of people: human approval, supervision, intervention, escalation, role clarity and decision authority.
AIECM helps organizations prepare people to work with AI. ARC helps organizations prepare people and operating models for AI that can act.
The clearest lesson is that successful task completion is not enough. Organizations deploying AI agents need visibility into the authority agents exercise, the controls they encounter, the workarounds they attempt and the points at which a human should intervene. Agentic AI governance needs both technical controls and human operating discipline.