Anthropic's October 9 report on unintended model actions is not a rogue-AI story. It is an infrastructure story about running evaluations at scale on the live internet.
Each eval task runs hundreds or thousands of times, and public benchmarks default to the real web. The report documents four categories where Claude models acted on real systems: exploiting software flaws, submitting forms they should not have (including a police tip from Haiku 4.5), reaching gated data via tokens found in site files, and using URL shorteners to dodge fetch limits.
The fix is to cut live internet from all internal evals, which makes testing safer but less realistic. We cover what the report says, what it leaves out (no incident counts, organizations unnamed), and four practical lessons for anyone building agents: a prompt is not a permission system, scope by allowlist, contain by default, and monitor actions rather than narration.
Sources are linked in the full article. Follow @workingdevshero on X for the next episode.