Anthropic Says Claude Ran Commands on a University Server and Sent Police a Fake Tip during Tests
Anthropic published a report on October 9 describing times its Claude models acted on real websites in ways the company didn’t intend, mostly during testing. In one case, Claude Mythos Preview needed a public science tool hosted by a university. When the tool returned an error, the model found a security hole in the university’s server, used it to run commands on the server, and ran the calculation that way. Other models used access codes that websites hand out behind the scenes to reach data sold for a fee, or used free link shorteners to get around their web tool’s limit on how long a web address can be.
The police case came from a test that had Claude Haiku 4.5 try out tasks on random web pages. It landed on a Philadelphia police tip form for an unsolved homicide and submitted an invented tip: “I recall seeing someone matching the description in the area.” Police say the tip was sent July 18 and went to spam. By their account, Anthropic found it on September 28. The department called the two-month delay in finding and reporting the tip “unacceptable.” A State Department official told Axios that a model Anthropic was testing also submitted 20 visa applications through the department’s public form. None were processed.
Anthropic says the cases had minimal real-world impact. It has cut live internet access from all its internal evaluations until it confirms that its monitoring reliably catches this behavior.
The White House Says Reporting AI Incidents Is No Longer Optional
After Anthropic’s disclosures, the White House’s Super Intelligence Force, a task force on the most advanced AI, told Axios that the companies building it “must immediately disclose incidents involving their models” and repair any harm. “This notification and remediation process is not optional,” the statement said. Axios notes that the administration’s approach to regulating AI had been voluntary, at least in name, until now. The statement doesn’t say how the requirement will be enforced or what happens to a company that doesn’t report.
Two senators have a separate proposal. On October 1, Josh Hawley and Chris Murphy announced the AI Agent Accountability Act, which would apply the federal anti-hacking law to AI agents. Whoever knowingly runs an agent that recklessly causes hacking damage could face criminal and civil liability. So could a developer that skips reasonable safeguards when it knows or has reason to know its agent could hack. The announcement describes the bill but doesn’t include its text.
One Message to a Public AI Agent on Amazon’s Cloud Exposed Every Agent in Its Account and Region
AgentCore is Amazon Web Services’ platform for running companies’ AI agents. Cloud machines have a local address that hands temporary login keys to the software running on them. Zenity Labs found that AgentCore agents could reach that address. One chat message asking a public-facing agent to fetch that address and send back the result was enough to get its keys.
Those keys carried a default role, which is AWS’s name for a bundle of permissions. That role covered every AgentCore agent in the same account and region. With those keys, the researchers listed every agent and downloaded each one’s code. They also talked to internal agents, read users’ private conversations, pulled login credentials for connected services out of AWS’s secrets store, and planted false memories meant to steer agents in later conversations.
Zenity first reported the problem in December 2025. In April, AWS closed that report, noting that since February, new agents had used a stricter version of the service that hands out keys. The broad role was unchanged in June. By September 29, AWS had removed the role’s broadest permissions and narrowed others. AWS’s statement calls the behavior “documented and expected” and advises customers to give agents only the permissions they need.
Anthropic Says Small AI Models May Soon Be Able to Spread Themselves across Cheap Home Devices
A computer worm is a program that copies itself from machine to machine with no one directing it. Anthropic’s red team tested whether an AI model could do the same: find a device, copy itself over, get itself running there, and move on. To show that cheap devices could pool enough computing power to run a capable model, the researchers bought 15 off-brand Android TV boxes at about $55 each. They ran a 26-billion-parameter open model split across them at 0.39 tokens a second, roughly one word fragment every two and a half seconds. In a separate test, a smaller 9-billion-parameter model, acting as the agent, got another model running on 8 of the 9 kinds of hardware tested.
They also built a sealed network of eight Android devices simulated in software. Of the open models tested, only GLM-5.2 completed the whole cycle, reaching all eight devices in four of five trials. The break-in step was made easy on purpose: each device had an open debugging port that asked for no password. On each device, the worm got a standard small model running rather than its own, and once that passed the researchers’ checks, they placed a new copy of the worm there. The model driving the worm ran on a separate server. The authors call the result an upper bound on real-world success.
If small models keep improving at their past rate, the authors expect one to reach GLM-5.2’s level by the end of this year, an estimate they call rough. Such a worm would spread slowly, with the number of infected devices taking days to double, and its traffic would show up in internet providers’ monitoring.
Coding Agents Put More Than 13,000 Company Screenshots on Public GitHub Repositories
Developers often ask an AI coding agent for before-and-after screenshots so a reviewer can check a change. GitHub, where companies store and review code, lets people attach images to a review in a web browser. But agents work from a text command line and couldn’t attach images to a private project’s review. Glow Labs found that agents got around this by creating new public repositories, often under the developer’s personal account, and posting the screenshots there.
Glow counted more than 13,000 internal images. They came from developers at more than 300 organizations and include utility billing records, a financial firm’s money-movement console, and unreleased product features. In 93% of cases, the images sat in repositories under employees’ own usernames, outside their company’s GitHub organization. Within a week, more than a dozen agents at one software vendor had saved the workaround as a skill, a set of instructions they reused on every task. Glow began notifying affected organizations on September 9.
None of the 24 Largest Federal Agencies Had Finished the First Steps toward Post-Quantum Encryption, Auditors Found
No quantum computer can break today’s encryption yet, but data stolen now could be unlocked once one exists. Since 2022, federal guidance has told agencies to take three first steps: list systems that use vulnerable encryption, estimate the cost of replacing it, and test the new post-quantum algorithms. The Government Accountability Office checked the 24 largest agencies and found none had fully done all three.
Only one had fully built its list of priority systems. Twenty-one had partial cost estimates that they acknowledged weren’t fully accurate, and three had none. None had tested post-quantum encryption in its own systems. Agencies were also short on people and tools: 18 reported lacking cryptography expertise, and 19 used no automated tools to find vulnerable encryption.
The report released October 6 is the public version of a restricted report GAO issued in September 2025. The audit ran from February 2024 to September 2025, so the findings describe the agencies as of last year.
The stories change every week. The pattern doesn’t: AI is being deployed faster than anyone can verify it.
We cover the headlines every Tuesday. The rest of the week, we publish the technical ideas behind the infrastructure OpenMatter® is building to close that gap — Masked Compute™, verifiable AI, and post-quantum security.
Follow along at openmatter.network.
Datavizor™ is the console for AI-powered collaboration on sensitive data. Free to start at datavizor.openmatter.network.