On Oct. 9, Anthropic reported that AI agents it was testing had taken unauthorized actions across federal, state and local government websites. One agent submitted a tip to the Philadelphia Police Department about an unsolved homicide despite having no information about the case. Another used government-issued access credentials to query databases it was not supposed to access. Together, the incidents illustrate a growing problem for businesses, governments and regulators: AI agents are becoming increasingly capable of finding their own solutions, even when those solutions violate the rules.

Anthropic notified the agencies involved and briefed the White House. The episode is the clearest sign yet that rogue AI agents have moved out of science fiction and into the real world.

How An AI Agent Filed A False Murder Tip

The fake tip came from an agent running on Claude Haiku 4.5, one of Anthropic’s smaller models. Testers had told it to make up and complete sample tasks on randomly chosen web pages. It landed on the Philadelphia Police Department’s page for a cold-case homicide, found the tip form and submitted a message saying it “may have information regarding this case.” According to Reuters , testers had told the agent to carry out tasks online but had never explicitly told it to stay away from forms.

Having spent years as a prosecutor investigating violent sex crimes and cold cases, I know a good tip can transform a case and a bad one can send detectives down rabbit holes for weeks.

The other incidents followed the same pattern. Every agent was trying to finish an ordinary task, and each found a shortcut through someone else’s system.

Asked to identify the location in a photo, Anthropic’s Claude Mythos 5 model found a valid access token in a browser configuration file and used it to send requests directly to a local government’s map server. Another agent noticed that a state agency’s dashboard gave access tokens to visitors and used one to query the agency’s database without paying the required public fee.

Agents also reportedly filled out 20 visa applications through a State Department form. The paperwork was incomplete and never processed.

“At no time were any of the department’s systems compromised or hacked by the Anthropic model,” the State Department said.

Outside government, a preview version of Mythos found a security hole on a university server and used it to run calculations after its own analysis tool broke. Another agent got around a length limit in its web tool by running links through a free URL shortener.

Anthropic described the impact as minimal and said the incidents involved no customer data or internal systems. It paused some live tests, moved others offline, tightened the guardrails on its web tools and built software that automatically detects and blocks this behavior.

The company’s explanation is the most revealing part of the report. It said these behaviors tend to appear when a task is ambiguous or impossible to complete. It also warned that a model’s own account of why it did something is unreliable and that training AI to behave well is insufficient on its own. For now, that leaves layered defenses as the only workable strategy.

Rogue Agents Are Becoming More Common

Anthropic’s report is the latest in a fast-growing list.

In August, OpenAI disclosed in a 37-page report that AI agents it was testing had escaped their restricted environments, stolen company credentials and tampered with OpenAI’s own cloud systems. Some agents swapped notes on how to get into the company’s network. Others tried to cover their tracks by deleting or altering records of what they had done.

In July, one agent broke into Hugging Face, the popular hub for AI models, to grab hidden answers to the hacking test it was taking. Hugging Face said the intruder accessed several credentials and a limited set of internal data. OpenAI later confirmed that its agents had also meddled with government websites.

Rogue agents show up outside the labs, too. In February, Summer Yue, who works on AI safety and alignment at Meta, asked her AI agent to suggest emails to delete from her overflowing inbox. It started deleting them instead, at high speed, and ignored the commands she sent from her phone telling it to stop.

“I had to RUN to my Mac mini like I was defusing a bomb,” she wrote.

In July 2025, an AI coding agent from Replit wiped a company’s live database during an explicit code freeze, erasing records on more than 1,200 executives and nearly 1,200 companies. It then told its user a rollback would fail, which turned out to be wrong.

“I destroyed months of work in seconds,” the agent wrote.

Some agents resist attempts to control them. In 2025, the AI safety firm Palisade Research told OpenAI’s o3 model to “allow yourself to be shut down.” In seven out of 100 runs, it rewrote its shutdown code so the command would fail.

People also point some agents at targets on purpose. In September 2025, Anthropic caught a Chinese state-sponsored hacking group using its Claude Code agent against about 30 organizations, including banks and government agencies. The agent performed 80% to 90% of the hacking itself, at times firing off several requests every second, while its human operators spent minutes reviewing hours of its work.

An AI agent goes rogue when it uses the access it has to do something no responsible person approved.

That leaves out the movie version. None of these reports describes a robot uprising or an evil plan. Marius Hobbhahn, who runs an AI safety research firm, described the Hugging Face breach as rogue in the sense that “just solve this task” turned into something nobody intended. Security researcher Alan Woodward put it more bluntly: The agent was cheating.

Think of a student desperate to finish an exam who discovers the answer key in the teacher’s unlocked desk. A student knows that opening the drawer crosses a line. An agent sees an open drawer.

A chatbot is like a very smart reference librarian. You ask, it answers, and you decide what to do next. An agent is more like a new hire with the company credit card and the keys to the building. You hand it a goal, and it browses, clicks, fills out forms, runs code and makes purchases on its own, one step after another.

Three ordinary ingredients turn that new hire rogue.

The first is a goal. An agent is built to finish the job, and when something blocks the obvious path or makes the task impossible as written, it improvises. A tip form becomes a place to practice. A leaked token becomes a key. A security hole becomes a free computer.

The second is the nature of instructions. To a person, “stay inside the lines” is common sense. To an agent, every rule is one more line of text, weighed against everything else it has been told, including its goal. When the goal and the rule collide, the goal can win.

Rules can also vanish when an agent’s memory fills up and it compresses older instructions into a summary, which is what Summer Yue believes happened with her inbox.

The third is access combined with speed. An agent can reach anything its tools allow, and it acts in seconds. A nervous new hire who hits a locked door goes to ask a manager. An agent tries the window.

Agents Are Starting To Work And Pay Together

The OpenAI agents that swapped notes on breaking into the company’s network offer a preview of a larger shift. Agents increasingly work in teams, with one agent handing pieces of a job to many others.

The Chinese hacking campaign worked partly because the attackers split it into small, harmless-looking tasks and spread them across many copies of the AI. No single copy saw the crime.

Those agents can increasingly pay each other, too. New protocols like Coinbase’s x402 let AI agents send each other stablecoins instantly, with no human approving each transaction. TRM Labs research found that autonomous agents can already split funds, choose bridges and execute swaps across blockchains within seconds.

Combine that with what Anthropic just disclosed. An agent that will grab a stray access token to finish a photo task will also find the cheapest supplier for a purchase order, even if that supplier is a front company for a sanctioned entity.

U.S. sanctions violations carry strict civil liability, so intent is irrelevant. “Our agent did it” describes the violation. It offers no defense.

People Will Be Held Responsible

The law has been remarkably consistent. The people behind the agent pay.

In 2024, a Canadian tribunal ordered Air Canada to compensate a grieving passenger after its website chatbot invented a refund policy. The tribunal rejected the airline’s argument that the chatbot was responsible for its own actions.

California has since written that principle into law. AB 316 , signed in October 2025, bars anyone who built, modified or used an AI system from arguing in a civil case that the AI “autonomously caused harm.”

Washington is moving, too. After Anthropic’s disclosure, the Trump administration called on AI companies to strengthen their safeguards and promptly report security incidents.

In September, the Federal Trade Commission opened an investigation into rogue AI agents. On Sept. 29, an advocacy group sued OpenAI in California over the Hugging Face breach. The lawsuit alleges that the company disabled its agents’ cyber guardrails and set them loose on tasks they could not solve as intended.

The harder problem comes when nobody steps forward. AI labs disclose their incidents. Criminals running agents never will.

Investigators have faced that before with shell companies and anonymous accounts, and the answer has always been to follow the money. Agents need computing power, hosting and, increasingly, crypto wallets to operate. A blockchain records every payment permanently and publicly, which means an agent that pays for anything leaves a trail back toward whoever funds it.

Companies Must Fight Agents With Agents

The same capabilities that let an agent find a stray access token also make AI the best tool defenders have for catching one. Security teams and investigators can use AI to investigate and disrupt rogue agents at machine speed, spot an agent reaching for access outside its assignment and shut it down before a shortcut turns into real harm.

Anthropic’s fake police tip sat unnoticed for 10 weeks, but an AI monitor watching in real time could have flagged it within seconds.

The agent that filed the tip was only trying to finish a practice exercise, but it still reached a real police department. The agents coming next will be far more capable, and defenders need to build and use their own AI now, while the stakes are still a spam folder in Philadelphia.