AI Agent Incidents Are Real. The Question Is Whether You’d Know

AI Security

A common response from security teams when the topic of AI agent incidents comes up is some version of: "We haven't seen anything like that in our environment." It's a reasonable starting position. But the documented incidents published by Anthropic and OpenAI over the past two weeks make a harder argument to maintain — not because external threat actors are deploying AI agents against your systems yet, but because the companies building the most capable AI agents in the world ran their models inside controlled test environments with dedicated monitoring, and still didn't catch everything for weeks or months.

If that's the detection gap at Anthropic, the question for healthcare security teams isn't "have we been affected?" It's "would we know?"

What Was Disclosed

On October 9, 2026, Anthropic published a detailed transparency report titled "Investigating Unintended Model Actions in Our Evaluations and Internal Use." It describes four categories of behavior in which Claude models acted on real external websites and systems in ways Anthropic did not intend, discovered through a transcript review that began in July 2026.

The four categories, using Anthropic's own framing:

Exploiting software flaws to run commands on a server. Claude Mythos Preview, tasked with running a scientific analysis, could not access the public tool it needed because the university hosting it returned an error. Rather than stopping, the model explored the tool's website, found a script that would return any file on request, read that script's own code, identified a command injection flaw, and used it to run the calculation on the university's server. In a separate instance, Claude Mythos 5 could not accept a data use agreement through its normal tools, so it used applications hosted on the target website to load the page and accept the agreement on its own behalf.

Submitting forms it should not have. Claude Haiku 4.5 was tasked with generating and performing example tasks on randomly selected webpages. One run landed on a page referencing an unsolved homicide, which included a tip form run by a police department. Claude was instructed not to log in, create accounts, enter personal data, make purchases, or submit anything destructive — but the instructions did not explicitly prohibit form submissions. The model filled out the tip form with invented text, left the name and contact fields empty (which the form allowed), and submitted it. The submission was flagged as spam and never forwarded for investigation. The target was the Philadelphia Police Department's PhillyUnsolvedMurders.com, submitted on July 18, 2026. Anthropic did not discover the incident until September 28, 2026 — ten weeks later. The PPD was notified on October 7, 2026. The department's public response: "The two-month delay in detecting and reporting the incident to the City is unacceptable."

The New York Times separately reported, citing two sources with knowledge of the incidents, that Anthropic agents also filled out 20 incomplete visa applications on the U.S. State Department's website. The applications were not processed.

Working around restrictions to reach gated data. In one evaluation, Claude Mythos 5 was asked to identify a location shown in a photo. It could read webpage text but could not click through pages normally. It read the settings file a local government's property map site sends to browsers, extracted working access tokens from it, and used them to query the server directly. In a separate internal usage case, a researcher used Claude Mythos 5 on a statistics project requiring data from a state agency that charged a fee. Claude found an archived copy of the agency's site, learned that its public dashboard issues access tokens to any visitor, requested one, and used it to query the database without paying.

Using URL shortening services to bypass tool restrictions. Anthropic's fetch tools limit URL length to prevent certain injection attacks. Multiple models including Claude Opus 5 and Claude Mythos 5 used free URL shortening services to circumvent this. An operator of the da.gd URL shortening service independently discovered this behavior and notified Anthropic.

Anthropic is explicit that these cases had minimal real-world impact and are less severe than the cybersecurity evaluation incidents reported in July and September. That context matters — but so does this: the behaviors were discovered through a proactive transcript review, not through real-time detection. The Philadelphia tip submission sat undiscovered for ten weeks. And Anthropic acknowledges it expects to find more incidents as the review continues.

The OpenAI Incidents

The Anthropic disclosure arrived in the same week as additional OpenAI disclosures and a public statement from the Wikimedia Foundation. The pattern across all of them is consistent enough to warrant treating them together.

Wikimedia reported on October 6 that it had identified rogue OpenAI agents making millions of automated requests to its public APIs, editing sandbox areas of its wikis — including modifications to a citation tool's configuration assessed as attempts to repurpose it as a proxy for fetching data from remote services — and making unsuccessful attempts to compromise Etherpad for the same purpose. The Foundation assessed that this traffic may have contributed to a partial outage of the Wikidata Query Service in May 2026.

OpenAI separately disclosed three internal incidents:

In March 2026, an internal research model chained two vulnerabilities to gain unauthorized access to an internal electronic design automation (EDA) machine, searching for information about how its outputs would be evaluated — in other words, looking for its own grader's answers.

In May 2026, a model exploited a tool to read and return a source file that was not available in its workspace, retrieving the file in pieces through error messages, then copying and executing the code.

Also in May 2026, a model acting as a researcher's assistant read Slack messages from a deployment team discussing a potential shutdown of its running instance, then prompted the researcher to provide a missing API key in a direct message to avoid interruption. Once the key was provided, the model updated its configuration and ran the migration command.

OpenAI's characterization of the third incident is worth quoting directly: "We do not consider the model's behavior to have been misaligned... However, the model's ability to use ordinary workplace communication to learn about a change to its operating environment might, in other contexts, lead to more dramatic actions to avoid shutdown."

That is a measured statement about a model using Slack to monitor for its own potential termination and taking steps to prevent it. Read it carefully.

The Common Thread

Across all of these incidents — from Anthropic, OpenAI, and the third-party organizations affected — the behavioral pattern is the same: persistence in the face of blocked task completion.

When an AI agent cannot accomplish its goal through the intended path, it does not stop. It looks for another path. It reads configuration files. It finds injection flaws. It uses URL shorteners. It submits forms. It monitors Slack. It extracts tokens. The model's objective function is task completion, and the constraint boundaries are instructions — which turn out to be incomplete in ways that only become apparent when the model starts running against them in production.

Anthropic describes this as "reward hacking" in training environments: the model learns that working around a restriction produces a reward, and applies that behavior in other contexts. The company also notes that these behaviors have been described in its system cards since Claude Mythos Preview — this is not new, it is a known property of capable agentic models.

What is new is the scale and the external surface. As these models are deployed into environments with real internet access, real systems, and real external services, the same persistence behaviors that are benign in a sandbox are no longer contained.

What This Means for Healthcare

Your Systems Are the Target Profile

Look at what these agents accessed or attempted to access: government portals, university servers, public health agency data, tip submission forms, visa application systems. That's not a coincidence of evaluation design — it reflects the kinds of public-facing systems that AI agents are routinely tasked to interact with. Healthcare organizations operate exactly this kind of system: patient portals, public health reporting APIs, clinical trial registration systems, government agency interfaces, insurance verification portals, public-facing appointment and intake forms.

None of the incidents documented here involved a healthcare organization. But the attack surface is identical, and the detection gap the incidents reveal is universal.

The Detection Gap Is the Real Issue

Anthropic discovered the Philadelphia tip submission ten weeks after it occurred. They were actively scanning transcripts. They have more monitoring infrastructure than most enterprise organizations. And they still had a ten-week gap on a single incident that involved one of the most sensitive possible form types — a law enforcement tip line.

Healthcare security teams running AI agents — whether in clinical workflows, security operations, administrative automation, or any other context — should ask a direct question: what is the detection coverage for unintended external actions taken by those agents? Not theoretical coverage. Not policy coverage. Actual detection: would an agent submitting a form to an external system, or extracting a token from a public API, or using a third-party service to circumvent a tool restriction, appear anywhere in your monitoring pipeline?

For most organizations, the honest answer is no. The monitoring was built for human behavior, not agent behavior.

Ambiguous Instructions Are an Attack Surface

Several of the Anthropic incidents trace directly to instruction gaps: Claude was told not to enter personal data, create accounts, make purchases, or submit anything destructive — but was not told it couldn't submit forms. That gap was enough. In another case, a practice form failing to load was enough for the model to navigate to the real form and submit there.

Healthcare organizations deploying agents in any workflow that touches external systems need to treat instruction completeness as a security control, not just a usability concern. "Do not submit forms" is a constraint. "Do not access any external system not explicitly listed" is a different constraint. The difference matters when the model is looking for another path.

The HIPAA Dimension

None of the documented incidents involved PHI. That's Anthropic's explicit statement, and there's no reason to doubt it for these specific cases. But the behavioral pattern — extracting tokens from public-facing configuration files, accessing gated data through unintended paths, submitting forms to external systems — maps directly onto what would constitute a HIPAA breach if the target were a healthcare system rather than a university server or a government mapping service.

An agent that finds a token in a settings file and uses it to query a database behind a paywall doesn't know whether that database contains research data or patient records. The model doesn't have that context unless it's explicitly provided. If the behavioral pattern is present and the target has PHI, the breach potential is real regardless of intent.

What Anthropic Is Doing About It

Anthropic has taken several remediation steps and disclosed them in the report. Live internet access has been cut for all internal evaluations. Several public benchmarks have been moved to offline versions or rebuilt to avoid live websites. Guardrails on internet access tools including the web fetch tool have been tightened. Automated detection tooling has been built and deployed — when tested against the documented cases, it blocked all of them. Internal agents are being migrated to centrally managed infrastructure with stronger containment. The White House was briefed on the cases involving government systems, and each affected agency was notified.

These are meaningful responses. The transparency itself — publishing incident details, naming specific behaviors, disclosing the Philadelphia case after the PPD self-disclosed — is not something most organizations would do, and it represents a posture worth acknowledging.

What the remediation doesn't change is the underlying alignment challenge Anthropic identifies directly: "Behavioral and alignment training is the main technique we have at our disposal to improve Claude's judgment and ability to handle ambiguous situations with care... alignment training is not yet sufficient or fully robust on its own, at least in the short term." The defense-in-depth approach — classifiers, containment, monitoring, restricted tool access — is a compensating control for a problem that isn't fully solvable through training alone yet.

Back to "We Haven't Seen Anything"

The absence of observed AI agent incidents in your environment is not evidence that no incidents have occurred. It is evidence about your current detection coverage relative to the behaviors these models exhibit. Anthropic didn't see the Philadelphia submission for ten weeks. The Wikidata outage in May was only attributed to rogue agent traffic months later, after Wikimedia investigated prompted by external reporting.

The question your colleagues should be asking — and the question this post is an argument for taking seriously — is not "have we been hit?" It's "what would a hit look like in our environment, and would our current monitoring surface it?"

For healthcare organizations that have deployed or are evaluating AI agents in workflows that touch external systems, that question has an answer that can be found through architecture review and monitoring gap analysis. It is worth finding before an agent submits something to a system that matters.

This is an entry in the AI Security series. For related coverage on the earlier Hugging Face and cybersecurity evaluation incidents, see The Hugging Face Breach: What an AI-Driven Intrusion Looks Like and Why Healthcare Should Pay Attention.