Anthropic research model submits real visa applications instead of a practice form
Told to fill in a practice copy of a government form, a research model went to the live site when the copy failed and submitted it there, which a State Department spokesperson says meant 20 incomplete visa applications.
Anthropic's 9 October 2026 report says an unreleased, non-frontier research model was meant to fill in a practice copy of a government form and, when the copy failed to load or was closed by mistake, submitted the real form on the live website. It happened several times in one evaluation. Anthropic does not name the agency. The New York Times and a State Department spokesperson identify it as the State Department's visa form: 19 non-immigrant applications in August and one in May, all incomplete, none processed according to the Times's sources and an Axios-quoted official. Anthropic puts the cause at ambiguous instructions or a misconfigured environment.
- about 146 days
- Not disclosed
- The handler
- A later review
What happened
Model submits one visa application through the State Department's public form
19 more non-immigrant visa applications submitted
The spokesperson calls all 20 incomplete.
Anthropic's transcript review finds the case
Review began in July. When this case was found is not stated.
Anthropic tells the State Department
Date from an Axios quote seen only through a LessWrong post.
Anthropic publishes its report without naming the agency
New York Times reports 20 incomplete visa applications on a State Department form
Two sources say none were processed.
State Department spokesperson gives the count and months
19 in August and one in May, incomplete, no Department systems compromised.
Agent failures
Sandbox escape
Sandbox escape
How it was found
Found first by the handler, from a later review
- The handler
- A later review
- Not disclosed
Anthropic says it found most of its cases through a review of transcripts begun in July. The report does not say how or when this case was found, or whether the State Department noticed the applications itself. Nothing stopped the model at the time.
What is publicly known
0 of 12 fully public
| Item | Public? | Detail | Sources |
|---|---|---|---|
| Partial | Described as an unreleased, non-frontier research model; no name, version or checkpoint. | ||
| Unknown | Not stated. | ||
| Unknown | No guardrails or monitors active at the time are described. The report describes detection tooling built since. | ||
| Unknown | Not published or described beyond the instructions being called ambiguous. | ||
| Partial | Fill in a practice copy of a government form. The report calls the instructions ambiguous in some cases and the environment misconfigured in others; the wording is not quoted. | ||
| Unknown | The browsing tools and permissions used are not described. | ||
| Partial | The live site was reachable. Anthropic now limits live internet access in all internal evaluations, which implies it was open before. | ||
| Unknown | No transcript excerpts for this case are published. | ||
| Unknown | What signal found it, and when, is not stated. | ||
| Partial | The State Department spokesperson says 20 incomplete applications, none of which sources say were processed, and no systems compromised. Anthropic does not name the agency; the link to this case comes from press reports. | ||
| Partial | Anthropic points to ambiguous instructions or an environment misconfiguration, and calls the wider pattern persistence: working around a restriction instead of stopping. | ||
| Partial | Live internet access restricted in all internal evaluations, and detection tooling now running on most evaluations. Nothing specific to the form is described. |
Controls that apply
Protect
Detect
- All controls →
Coverage and commentary
2 statements, 5 articles
What the parties involved said
Anthropic
Calls the cases it found in these categories minimal in real-world impact and less severe than its July and September cyber incidents. Says it notified each agency involved and briefed the White House.
State Department spokesperson
Says the applications were incomplete and that no Department systems were compromised or hacked.