Skip to content
22ATLASStart your build

All articles

Technique

Your agent pressed submit

Anthropic's test agents filled out real forms on real websites, including one they were told to stop before sending. Here is a submit gate and a 24-hour incident drill for Always On Agents, in seven steps.

22Atlas

Product studio

6 min read

The agent can fill the form. A person, or a check that fails closed, presses submit.
The agent can fill the form. A person, or a check that fails closed, presses submit.

On Oct 9, Anthropic published a report on unintended actions its Claude agents took on real outside websites during testing and internal use. It sorts them into four kinds. Agents exploited basic software flaws to run commands on a server. They submitted forms they shouldn't have. They worked around token or fee gates to reach data. And they used URL shorteners to get past limits in their fetch tool.

Two of the form cases are the ones to read closely.

In the first, an agent generating example tasks landed on a police department's tip form. Anthropic writes that Claude "was instructed never to log in, create accounts, enter personal data, make purchases, or submit anything destructive, but the instructions did not rule out form submissions." It filled in an invented tip and sent it. The submission was flagged as spam and never forwarded for investigation.

In the second, Claude Haiku 4.5 was told to complete a form up to the final step and stop. Anthropic: "Several times Claude mistakenly submitted the form instead, expecting there to be an additional confirmation page."

Anthropic calls the real-world impact minimal and rates these cases "significantly less severe" than the cybersecurity incidents it reported on July 30 and Sept 9. It has turned off live internet access for all of its internal evaluations until its security and monitoring catch this behavior reliably. It also built detection tooling, and when tested against the cases in the report, "it blocked all of them."

The reaction is about time

The police department was Philadelphia's. Its statement, published in full by 6abc, says the tip came in through PhillyUnsolvedMurders.com on July 18. Anthropic found it Sept 28 and told the department Oct 7. Police found no sign of access to their systems, and their process requires human review before any tip goes to investigators. Their complaint was the clock: "The two-month delay in detecting and reporting the incident to the City is unacceptable."

Axios reported the same day that a State Department official said an Anthropic test model had submitted visa applications through the department's public form. The official said none were processed and no systems were compromised. Axios also published a statement from the White House Super Intelligence Force: "This notification and remediation process is not optional. It is a critical national security obligation."

That statement is aimed at AI companies, and Axios notes it didn't say how it would be enforced. It doesn't create a reporting duty for a store or an agency. But the expectation is now public. If an agent you run files something on a supplier's portal or a marketplace, the other side will ask the same two questions Philadelphia asked: when did you know, and when did you tell us.

If you haven't set default permissions for a browsing agent yet, start with Deny-by-default before you give the agent a browser. This note picks up where that one stops: the submit click, and the first 24 hours after something goes out anyway.

Seven steps

  1. List every live site and form your agents can reach.
  2. Write scope as an allow list.
  3. Put the submit click in the tool.
  4. Make every check fail closed.
  5. Read the logs every week.
  6. Write the 24-hour drill on one page.
  7. Guard your own inbound forms.

1. List the sites and forms

Start with an inventory. Supplier and 3PL portals. Seller Central or Shopify admin. Ad accounts. Review platforms. Support and returns forms on other people's sites. Wholesale applications. Tax portals.

For each one, write which agent can reach it and whether it can only read, can fill in fields, or can send. Expect a few surprises. A browsing agent follows links.

2. Write scope as an allow list

The tip form instructions banned five things and missed the sixth. A list of what the agent may not do will always have a gap.

Anthropic draws a similar lesson. Some failures might have been avoided if the tasks "had more clearly stated what was in and out of scope for the exercise, including the targets, permitted actions, and network boundaries."

So name the sites the agent may visit and what it may do on each. Anything not on the list is read only, or off limits.

3. Put the submit click in the tool

"Stop before submit" in a prompt is a request. Haiku 4.5 pressed the button because it believed another screen was coming.

Move the stop into the tool. The agent fills the form and hands back a filled draft: the URL, every field and its value, and a screenshot. A person reviews it and presses submit, or an approval step does it after a person says yes. The agent's own browser session never gets to send.

4. Make every check fail closed

An approval check that crashes shouldn't wave the action through. On Oct 8, Claude Code v2.1.295 added onFailure: "block" for command and HTTP hooks, so "a hook that can't start, times out, or exits with an unexpected code blocks the action instead of letting it through."

That setting belongs to Claude Code. On another stack, test the same thing by hand. Break your approval check on purpose, run the agent, and confirm it stops.

5. Read the logs every week

Anthropic describes most of these cases as persistence: when Claude couldn't finish a task as given, it worked around a restriction instead of stopping. Tell your agents to stop and report when they hit a wall. Then check that they did.

Set a weekly slot for each agent with web access. Look for URL shorteners, reused tokens or keys pulled from a page, skipped fees or paywalls, any form it sent, and tools it called that it wasn't given. Philadelphia's tip sat for more than two months before anyone noticed. A weekly read keeps that window to days.

6. Write the 24-hour drill on one page

Write it before you need it. One page, one named owner. Fill in four things:

  • Who stops the agent and how: the switch, the key to revoke, the account to suspend.
  • Who tells the site owner, and any customer affected, and by when.
  • What gets undone: withdraw the submission, cancel the order, retract the review, and keep the log.
  • What changes: which site comes off the allow list, and which check gets added.

Then run it once on a made-up case, like an agent that filed a returns request on a supplier portal. If nobody can find the off switch fast, fix that first.

7. Guard your own inbound forms

Agents fill your forms too: contact, returns, reviews, wholesale and affiliate applications. The Philadelphia tip went nowhere because a spam filter caught it and the department has a person review tips before anyone acts on them.

Copy that. Keep a rules check or a person between any form submission and a refund, store credit, discount, or public reply. Watch for submissions with empty contact fields and confident details nobody could know.

This week

Do the inventory and the allow list for the agent with the most web access. Move its submit click into the tool and break the check once to see it fail closed. Put the weekly log read on the calendar. Then write the one-page drill and run it.

Tell us which jobs you want off your plate. We install Always On Agents in your own agent account. We still take on build work too. Start your build or write hello@mail.22atlas.com.

Linked sources

Get our Articles and posts by email.

Up to one email a day with new Articles and posts from 22atlas.com and sean-weldon.com, plus occasional news about 22Atlas services.

Also on the desk