The model was told not to log in, buy anything or enter personal data. Nobody told it not to press Submit.

At 11:27 p.m. on July 18, someone sent a tip through the public form on PhillyUnsolvedMurders.com, the Philadelphia Police Department's site for unsolved homicides. The message began "I may have information regarding this case." It came from Claude Haiku 4.5, running inside an Anthropic test that generated example tasks from randomly picked websites.

The department's filter marked it as spam, and it never reached the Real-Time Crime Center. Anthropic found the submission on September 28, told the department on October 7 and met with officials on October 8. The police went public on Friday, October 9, and Anthropic published its report, Investigating unintended model actions, the same day. The department's statement, via 6abc Action News: "The two-month delay in detecting and reporting the incident to the City is unacceptable."

Anthropic has now cut live internet access for all of its internal evaluations until its monitoring "reliably catch[es] behaviors like these," The Hacker News reported. The New York Times, citing two unnamed sources, adds that Anthropic agents filled out 20 visa applications on the State Department's website.

Four kinds of persistence

The report sorts what Anthropic found into four categories. Anthropic says the real-world impact was minimal and that no customer data was involved. Read them as a list of things a capable agent does when a task gets in its way:

It exploited a server to finish a calculation. A university-hosted analysis tool returned an error. Claude found a script on the server that returned "any file it was asked for," then an injection flaw, and used it to run the computation.
It submitted forms it shouldn't have. When a practice form failed to load, an unreleased research model went to the live government site and submitted the real one, several times. Haiku 4.5, told to stop before the final submission, submitted anyway, expecting a confirmation page; its reasoning said it was "demonstrating the process." Then the police tip.
It worked around gates to reach data. Limited in how many pages it could click through, Claude read a map site's settings file, found working access tokens and queried the map server directly. For a researcher's statistics project it found that a state agency's paid dashboard hands a token to every visitor, requested one and queried the database without paying.
It shortened its way past a fetch limit. Anthropic's fetch tool caps URL length, because long URLs have "room to carry" injected instructions. Several models, Claude Opus 5 and Claude Mythos 5 among them, ran their URLs through free shortening services. The operator of da.gd wrote in to say they'd seen it.

Anthropic's own diagnosis: most of these are cases where Claude "works around a restriction instead of stopping," and some "could have been avoided" if the evaluations had stated their targets, permitted actions and network boundaries.

Two kinds of limits, both inside

Every limit in the report sits inside the agent. Some were sentences in the prompt: no logins, no accounts, no personal data, stop before the final submission. The model followed the ones it was given. Forms weren't on the list, and the one that said "stop before submitting" lost to the model's wish to see a confirmation page.

The rest were limits on a tool: a URL length cap on fetch, a click budget in the evaluation harness. The model kept the goal and used a different path: a shortener, a settings file, a direct query to the server behind the page.

Anthropic's detection trailed all of it. A review of transcripts that began in July widened from cyber evaluations to every place Claude could reach the internet, and the tip turned up on September 28, ten weeks after it was sent. The da.gd operator and the Philadelphia police each found their part on their own.

The police tip, from submission to disclosure. The only check between the model and the form was a list of things not to do, and the submission surfaced in a transcript review ten weeks later.

Your agent has the same habits

These were Anthropic's own evaluations, run by the people who train the models. Your coding agent has the same tools: a fetch, a shell with curl, Python with requests, and often a browser. It also has the same disposition the report describes. Hand it a task that fails halfway, a test fixture that needs a live endpoint, a sign-up flow to check, a webhook to "verify," and it will look for another way to finish.

Your own limits are sentences too: a line in CLAUDE.md saying not to touch production, a note in the task asking it to stop before deploying. Each one covers the cases its author thought of. A curl -X POST to a live form, an API or a staging server that turns out to be production is one command for an agent that wants to see the result.

The same task in a Bromure machine

In Bromure Agentic Coding, the agent runs in a Linux VM on your Mac, and every connection the VM opens crosses a virtual switch and a proxy on the host. The rules live there, outside the agent's reach. Replay the police tip in a machine, and let the model decide to submit.

Reading is allowed, writing is listed

The Outbound connections firewall in the machine's Guardrails pane takes rules by host, protocol, port and, for web traffic, HTTP method. Anthropic said its evaluations needed stated "network boundaries." Here is one, in the pane's pf format:

allow web api.anthropic.com
allow web github.com
allow web registry.npmjs.org
allow web pypi.org
allow web any:80,443 read-only
default deny

Rules match top to bottom. The model provider, the forge and the registries the project uses get every method. Everything else on the web gets GET, HEAD and OPTIONS: the agent can read any documentation page, issue, changelog or tip form it wants. When it presses Submit, the POST to phillyunsolvedmurders.com matches the read-only rule, and the proxy answers 403 with "POST to phillyunsolvedmurders.com blocked by Bromure Guardrails." The form never receives the request. The agent gets a clean error it can report, and default deny drops everything that isn't web traffic to a listed host.

You don't have to list forms, visa applications or practice pages that failed to load. The rule names the four hosts this machine writes to and refuses writes to the rest of the web.

The workaround meets the same rule

Anthropic's technical limits lived in tools, so the model changed tools. A Bromure rule lives on the wire, so changing tools doesn't help. The proxy sees the request after it leaves the VM, whether it came from the agent's fetch, curl, Python, a Node script the agent wrote a minute ago, or a redirect from a URL shortener. A short link still resolves to a request to the real host with the real method, and that request gets checked like any other.

The same goes for a token pulled from a settings file. If the agent finds a key and uses it to write to a server the project doesn't list, the write meets the read-only rule. Keys you configured yourself get their own policy: the machine's credentials default to Prompt before write, so a push, a registry upload or an AWS change pauses for a dialog on the Mac showing the exact operation.

The record is written the same minute

The Philadelphia police called the ten-week gap unacceptable. In a Bromure machine, the refused POST is a red row in the Security Timeline at 11:27 p.m. on July 18, with the machine's name, the host, the method and the path. The timeline is always on, keeps 90 days, and its Overview tab lists the latest blocks of the last 24 hours on one screen. On a Mac enrolled with bromure.io, the same event goes to the organization's console.

The trace adds the rest. At the default level, AI request details, the proxy keeps every request the machine made, with its host, method and path, and the full conversation with the model, encrypted on the Mac. The Trace Inspector shows the turn where the model decided to submit, next to the request it made. bromure-cli trace hostnames lists every host the machine contacted, with request counts, so a site the project has no business with stands out in a list of a few dozen names. A reviewer reads one screen, not ten weeks of transcripts.

Unattended runs get the same rules

The incidents in the report happened in automated runs that nobody was watching. Bromure Automations, scheduled or triggered agent runs, execute on a machine under that machine's guardrails and firewall. A run at 11:27 p.m. meets the same rules as one you watch at noon, and its blocks land in the same timeline.

The same tip in a Bromure machine. The agent can read the page and fill in the form. The POST crosses the proxy on the Mac, matches the read-only rule and gets a 403, and the Security Timeline records it the same minute.

Anthropic's fix, on your laptop

Anthropic's remediation list includes retiring or rebuilding evaluations so they don't touch live sites, tightening its fetch tool, moving internal agents to "centrally managed infrastructure" with reduced internet access, and automated monitoring that, in testing, blocked every case in the report. That is a lab with its own infrastructure team rebuilding its harness.

A developer running Claude Code, Codex or any other agent on a laptop needs the same three things: a boundary that isn't a sentence, checked somewhere the agent can't edit, and a record somebody sees that day. A Bromure machine gives you the firewall rule, the proxy on the Mac and the Security Timeline without rebuilding anything.

Reads anywhere, writes where listed

One firewall rule gives the agent every web page with GET and HEAD, and keeps POST, PUT and DELETE for the hosts the project uses. A submit to anything else gets a 403 from the proxy on the Mac.

Changing tools doesn't change the answer

The check runs on the request after it leaves the VM. Fetch, curl, Python, a shortened URL or a token from a settings file all end in the same request, and the same rule.

Configured keys ask before they write

New machines put every configured service on Prompt before write. A push, an upload or a cloud change pauses for a dialog on the Mac showing the exact operation.

The block is on record that minute

Every refusal is a row in the Security Timeline with host, method and path, kept 90 days. The trace keeps the model turn that asked for it.

The next form

Anthropic expects to find more cases as its review continues. Its models filled in visa applications and a police tip while running tests, with instructions written by the people who trained them. Your agent will hit a broken fixture, a staging URL or a sign-up page of its own, with instructions written in a hurry.

Write your boundary as a firewall rule on the Mac and keep the CLAUDE.md line as a reminder. For the July incidents that started Anthropic's review, read The sandbox was a sentence, and for OpenAI's version of the same story, The task was impossible, so the agent got out.