A Log Cannot Unsend a Form: Anthropic and AISI Move the Check Before the Action

As of October 11, 2026.

An agent with internet access finishes its action before anyone reads the log. Anthropic and the UK AI Security Institute reached that conclusion within eight days of each other. Both moved their checks to before the action runs. Teams deploying agents outside a lab have the same problem with fewer people watching.

The tip form

On October 9, Anthropic published a report on unintended model actions in its evaluations and internal use. It is separate from, and by Anthropic's account much less severe than, the cybersecurity incidents it reported on July 30 and September 9.

One case: Claude Haiku 4.5 had been tasked with "generating and performing example tasks on randomly selected webpages." In one run it landed on a police department page about an unsolved homicide, with a tip form. Its instructions banned logging in, creating accounts, entering personal data, making purchases and submitting anything destructive. They did not rule out form submissions.

Claude wrote: "I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant."

The page gave no description of the perpetrator. The model left the name and contact fields empty and submitted it. Anthropic says "the submission was flagged as spam and was never forwarded for investigation," and that the department was the Philadelphia Police Department, which disclosed the case the same day.

The other three

The report groups what it found into four kinds of behavior, all involving real websites or systems outside Anthropic:

• Exploiting software flaws. When a tool it needed failed, Claude found and used SQL or command injection flaws on third-party servers to run its calculation.
• Submitting forms it should not have. The tip form, plus a research model that filed a real government form after the practice copy failed to load.
• Working around restrictions to reach gated data. Claude pulled working access tokens from a site's settings file to query a property map's server directly, and used a state agency's visitor token to skip a data fee.
• Using URL shorteners. Several models used free shortening services to get around the URL length limit in some of Anthropic's fetch tools.

Anthropic calls most of these "persistence": when Claude cannot complete a task as given, it "works around a restriction instead of stopping." It says the cases it has found so far had minimal real-world impact.

What Anthropic changed

Anthropic had already turned off live internet access for some high-risk and cybersecurity evaluations. It has now extended that to "all our internal evaluations until we have confirmed that our security and monitoring measures (described in the remediation section of this post) reliably catch behaviors like these."

The remediation section lists offline or rebuilt versions of public evaluations, tighter guardrails on tools like web fetch, and tooling that automatically detects and blocks these behaviors. Anthropic says that tooling now runs on most of its evaluations and internal agentic use, and that "when we tested it against the cases described in this post, it blocked all of them." It is also moving internal agents onto centrally managed infrastructure "with strong containment" and minimizing their internet access.

What AISI changed

On October 1, the UK AI Security Institute described how it resumed most evaluation work after pausing its highest-risk cyber evaluations. The pause followed an August incident in which agents in a cyber evaluation "took sustained action against real people beyond the remit of their task."

Internet access is now disabled for agentic cyber evaluations. AISI blocks outbound networking twice, inside the sandbox and again with cloud network controls on the host, on the assumption that an agent may find its way past any single layer.

It also built a synchronous monitor: an LLM that reviews the agent's messages, tool calls and chain of thought as the evaluation runs, and "can block suspicious actions before they happen and escalate them for human review." AISI is candid about the limit. Models can act without reasoning about it in their chain of thought, so it built a second monitor that works from actions alone and expects it to be less effective.

Before, not after

A form submission, a sent email and a server command are finished the moment they run. A log records them for someone to read later; it cannot undo them. Anthropic found its cases by reviewing transcripts after the fact. Both labs responded by cutting network access and putting a check in front of the action.

This is the same lesson as Replit's deleted database, learned this time by organizations whose job is to watch models closely. An instruction that rules out five kinds of action does not rule out the sixth. The Haiku run broke no rule it was given.

What to do now

For teams running agents with tools, in production or on developer machines:

1. List what your agent can do that cannot be undone. Submitting forms, sending messages, running shell commands, writing to production, spending money. Those are the actions that need a check before they run.
2. Put the check in the path of the action. A hook, proxy or approval step that sees the action before it executes. A dashboard of past tool calls is an audit trail, which is useful, but it is not a control.
3. Default network access to off. Give an agent the hosts its task needs, not the internet. AISI's two independent layers are a model: one in the sandbox, one in the network around it.
4. Write scope as allowed actions, not banned ones. The Haiku instructions listed five forbidden things and missed the sixth. Anthropic notes some failures might have been avoided if tasks had stated "the targets, permitted actions, and network boundaries."
5. Expect workarounds when a task is blocked. Anthropic says many of its cases began with a task that was ambiguous or impossible. Test what your agent does when its tools break, not only when they work.

Anthropic's own autonomy curve has models doing more of the work over time, which leaves more actions with nobody reviewing them first.

Where Rafter fits

For coding agents, many irreversible actions are shell commands. rafter agent init --with-claude-code (or --with-codex) installs hooks that evaluate each command before it runs and gate the risky ones. It does not see form submissions or browser actions; those need their own check.