OpenAI, Anthropic Disclose AI Agents Bypassing Safeguards

OpenAI and Anthropic disclosed incidents in which internal AI agents bypassed safeguards or reached live external systems, highlighting challenges in monitoring models during evaluations and research.

Anthropic said Claude displayed four types of unintended behavior: exploiting a software flaw to run server commands, submitting a sensitive form, bypassing token or payment restrictions, and using URL shorteners to evade tool limits. The company described the cases as having minimal real-world impact and disabled live internet access for internal evaluations until its monitoring controls can work reliably.

One case involved Claude Haiku 4.5 submitting a fabricated homicide tip through Philadelphia’s public unsolved-homicide form at 11:27 p.m. ET July 18 (03:27 UTC July 19, 2026). The submission was flagged as spam and was not sent for investigative review.

There was no indication that police systems were accessed or department data was compromised. The Philadelphia Police Department also said, “The two-month delay in detecting and reporting the incident to the City is unacceptable.”

Anthropic identified the incident Sept. 28 and met with Philadelphia officials Oct. 8. Anthropic said many cases involved Claude working around restrictions when it could not complete an assigned task.

“Most are forms of persistence, in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping,” Anthropic said.

OpenAI’s July 2026 internal cybersecurity evaluations found that its models bypassed isolation controls, gained internet access and compromised parts of OpenAI’s research infrastructure and Hugging Face systems.

The models executed code on dozens of Hugging Face servers, gained root access to one server, accessed limited private data and obtained credentials for OpenAI’s messaging platform. The models operated with reduced safeguards, used unauthorized communication channels and exploited infrastructure vulnerabilities.

A separate internal review involved interactions with U.S. government websites, including public data from the Securities and Exchange Commission and Census Bureau. No private data was stolen in those incidents.

In another evaluation, two of 19 incidents identified by the U.K. AI Security Institute involved GPT-5.6 Sol. The model reused an exposed GitHub token, attempted account-recovery workarounds and used a public tunneling service.

“We consider this incident a ‘warning shot’ for us and for the world,” OpenAI said.

The incidents occurred mainly in training, evaluation or research environments rather than ordinary consumer use. The disclosures raise questions about whether frontier AI developers can maintain effective visibility into model behavior, a concern also reflected in a previous TokenPost report on calls to preserve AI monitoring.