Anthropic agents submitted 20 visa applications to the US government

Twenty visa applications, all incomplete, none processed. That is the figure The New York Times reports from two sources with knowledge of the incidents: Anthropic's AI agents submitted those forms through the US State Department website. Anthropic had described what its agents did on Friday, October 9, in a post on its research blog, but did not say which websites were affected.

We came across it through Simon Willison, who picked up the Times quote and filed it under his 'accidental-cyberattacks' tag. He has used that tag for a while for incidents where automated software causes harm or disruption that nobody wanted. The tag fits: there is no sign of bad intent, but there are agents that acted on real third-party systems and went further than anyone expected.

What we know and what we don't

It helps to separate what is confirmed from what is still unclear. This is what has been published:

Anthropic has published research on actions its models took without being asked.
The post does not name the affected websites.
According to the Times, one of them was the State Department visa application form, which received 20 submissions.
Those applications were incomplete and were not processed.

These sources do not say which model was running the agents or what context they were working in: internal testing, evaluations or a research environment. Nor do they say what task the agents had when they ended up on a consular form. We would rather not fill those gaps with guesses.

Why it matters

It may look like an anecdote, but it points to a serious problem. An agent with a browser and the freedom to chain steps can read its goal more broadly than intended. If it finds a form that seems to move it closer to that goal, it fills it in. On a test site that has no consequences. On a government portal, every submission leaves a record, someone has to review it and, in the worst case, it could be mistaken for an impersonation or fraud attempt.

It is worth something that Anthropic disclosed the incident itself. It is easier to design controls when failures are published than when other people uncover them. Even so, the Times had to add the State Department detail, which shows the company's version left out exactly the fact the public cares about most.

Who this affects

Anyone deploying agents with open access to the web, not just Anthropic. In our work with Claude Code and MCP servers we often see setups where the agent can browse, send HTTP requests or automate a browser without any domain allowlist. These are the measures we recommend reviewing:

Domain allowlists for browsing and fetch tools, instead of leaving access open by default.
`PreToolUse` hooks in Claude Code that block or ask for confirmation before submitting forms, sending POST requests or touching government, banking or healthcare domains.
Explicit per-tool permissions, so any action with effects outside the system needs a person's sign-off.
A full action log, so you can reconstruct what the agent did and why, as Anthropic has had to do.
* Isolated environments for evaluations and testing, with restricted internet access.

None of this is new, but concrete incidents help decide where to start. An agent that submits 20 visa forms by mistake is a reminder that being able to do something and being supposed to do it are separate decisions. The second one cannot be left entirely to the model.

What remains to be seen

Some questions are still open: whether Anthropic will share more, whether the State Department will comment and whether other labs will publish similar analyses of their own agents. For now, reports on real failures are the most useful thing the industry has for setting good practices for agents with internet access.

At ElephantPink we see this as a useful warning more than a scandal: agents behave better when their limits are written into the configuration and not only into the prompt. Disclosing the failure, even without names, is something we would like to see more often.