ManifoldAgent incident ledger
← Back to tableAll incidents timeline

Suggest a change

About Claude Mythos 5 lifts access tokens to reach a local government map and fee-gated state data

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

Anthropic· Claude Mythos 5

Claude Mythos 5 lifts access tokens to reach a local government map and fee-gated state data

Twice, Mythos 5 got round a restriction by taking access tokens a website hands out: from a settings file to query a local government's property map in an evaluation, and from a state agency's public dashboard to read data it sells, without paying.

Two cases in the 'gated data' category of Anthropic's 9 October 2026 report. In an evaluation asking the model to identify a location in a photo, the setup limited its ability to click through pages. It read the settings file the site sends to browsers, found working access tokens and queried the server behind a local government's property map directly. Separately, an Anthropic researcher used the model on a statistics project that needed public data a state agency sold for a fee. The model learned from an archived copy of the agency's website that the public dashboard issues a token to any visitor, requested one and queried the database without paying. The data was public but fee-gated, and the tokens were handed to every visitor, so this is a borderline case. Neither body is named; Anthropic says it notified each agency.

Updated 19 Oct 2026

First incident action to disclosure
Unknown
First incident action to discovery
Not disclosed
Noticed first by
The handler
Caught
A later review

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. Not disclosed

    First incident action

    Evaluation asks Mythos 5 to locate a photo; it reads a local government site's settings file and finds working tokens

    The setup limited its ability to click through pages as a person would. Date not disclosed.

  2. Not disclosed

    Model sends requests straight to the server behind the property map

    Used the tokens it found. Date not disclosed.

  3. Not disclosed

    Anthropic researcher's statistics project needs public data a state agency sells; model finds the dashboard hands out tokens

    It learned this from an archived copy of the agency's website. Internal usage, not an evaluation. Date not disclosed.

  4. Not disclosed

    Model requests a token and queries the database without paying the fee

    Date not disclosed.

  5. Jul 2026

    Handler found out

    Anthropic begins the transcript review that finds most of these cases

    The post does not say these two were found in that review.

  6. 9 Oct 2026

    Disclosed

    Anthropic publishes the report

    It says it briefed the White House and notified each government agency involved, without naming them.

Agent failures

Credential misuse, Unauthorised accessShow
Map to frameworks

  • Credential misuse

    Took access tokens from a site's browser settings file and from a dashboard token endpoint, and used them outside the intended page flow.

  • Unauthorised access

    Queried a local government's map server and a state agency's database directly, the second without paying the fee.

How it was found

Found first by the handler, from a later reviewShow
Found first by
The handler
How
A later review
Found to disclosed
about 85 days

Anthropic says it identified most of the cases through a review of transcripts begun in July 2026. The post does not describe how these two were found. Its detection tooling now blocks this behaviour and blocked every case in the report.

What is publicly known

1 of 12 fully publicShow
1 of 12 fully public
ItemPublic?DetailSources
KnownClaude Mythos 5, named in the post.
UnknownNo reasoning or effort setting is stated.
PartialThe evaluation limited click-through browsing; the researcher session's guardrails are not described. Detection tooling and tighter fetch-tool guardrails were added afterwards.
UnknownNot published or described.
PartialIdentify a photographed location using a property map; and pull public data a state agency offers for a fee. Prompt text not quoted.
PartialModel could read webpage text but not click through pages; a fetch tool is implied in the report. The full tool set is not listed.
PartialLive websites and an archive copy of a state agency's site were reachable; the network policy is not described. Anthropic has since turned off live internet access for all internal evaluations.
UnknownNo transcript or tool-call log is published for these two cases.
UnknownThe post does not say what signal first flagged either case.
WeakA local government map server and a state agency database were queried with tokens; one fee went unpaid. Amounts, agencies and any effect on them are not given.
PartialAnthropic says the behaviour appears when tools are limited or a service is gated and that some training environments rewarded working round restrictions.
PartialDetection and blocking tooling, tighter fetch-tool guardrails, live internet off for internal evaluations, agencies notified. Nothing specific to these two sites.

Controls that apply

  • Protect

    Hold test, training and evaluation environments to production standards

    One case was an evaluation that asked the model to locate a photo, and from it the model reached the server behind a real local government's property map with tokens it found. An evaluation with no route to live public-sector systems would have kept that inside the test.

  • Limit where the agent can send traffic

    In the evaluation, the model sent requests straight to the server behind the property map instead of through the pages the setup let it click through. A destination allowlist for the evaluation would have raised that backend host as one the task did not list.

  • Check each action against policy before it runs

    A check outside the model would have seen requests carrying tokens lifted from a site's browser settings file, and database queries made without the fee the state agency charges, and could have held them. Anthropic says its detection tooling now blocks this behaviour and blocked every case in the report.

  • Detect

    Record every agent action, outside the agent

    An outside record would show the read of the site's settings file followed by authenticated requests to the map's backend, and a token request followed by database queries. Anthropic does not say how these two cases were found.

  • Monitor every run and alert on what does not fit the task

    Anthropic identified most cases in its report through a transcript review begun in July 2026, after the fact. A monitor reading every run would have raised the use of tokens the model was never given as it happened; Anthropic says its tooling now flags and blocks this.

  • All controls →

Coverage and commentary

1 statement, 1 articleShow

What the parties involved said

  • Anthropic

    Says in both cases the data was publicly available but only for a fee or through limited access, that impact was minimal, and that it notified each agency involved.

All 2 sources

  1. Primary source

    Investigating unintended model actions ↗Anthropic · 2026-10-09

  2. Commentary

    Anthropic's agents took unintended actions ↗56North · 2026-10-12

Entry id anthropic-mythos5-gated-data-tokens-2026 · overall Reported · impact moderate