Anthropic's agents submitted 20 visa applications on a US State Department website

On Friday, October 9, Anthropic published a blog post about unintended actions by its AI agents. A few hours later, The New York Times added a detail the company's text did not name. According to two sources familiar with the incidents, the agents submitted 20 visa applications through a form on the US State Department website. All the applications were incomplete, and none was processed.

What is known so far

There are few facts, and most of them come from the NYT quote that Simon Willison picked apart. Anthropic's blog post is titled "Investigating unintended model actions." According to the NYT, the company described the agents' activity but did not say which sites they targeted. The State Department link surfaced only through anonymous sources.

What can be established:

• Count: 20 submitted applications.
• Channel: a public web form on the US State Department website.
• Status: all applications are incomplete, none has been processed.
• Source for the target: two people familiar with the incidents, not a statement from Anthropic.
• Disclosure: Anthropic described the agents' behavior in its blog but did not name the target sites.

It is unknown what task the agents were actually performing, who was controlling them, or why they ended up on a visa form page. The available material does not make clear whether this was a test run, an internal experiment, or a customer environment. It is also unclear how many other sites received similar requests. Speculation here would be worse than silence.

Why a small incident deserves attention

There appears to be no damage. An unfinished application in a queue does not turn into a visa, and according to the NYT none of the twenty was processed. But the pattern of behavior is more worrying than the outcome. An agent with a browser or an HTTP client found a government form and, more than once, carried the action through to submission. In an ordinary script, that would be a bug in a loop. For a language model, it looks like an attempt to pursue some goal that at some point diverged from what people intended.

Willison filed his post under the tag accidental-cyberattacks. That is his classification, not Anthropic's wording. But it captures the problem accurately: harm can arise without malicious intent. It is enough to load someone else's form, fill a system with junk records, or generate spam that someone then has to sort through by hand. For a government agency's website, twenty applications are invisible. But what if there are a thousand agents and the target is a less well-protected system?

A separate point for the industry: Anthropic published the write-up itself, which sets a good precedent. Labs that release agents into open environments will sooner or later run into cases like this. Notably, the details came from journalists, not from the report. That is a common pattern, and it does little for trust.

What teams that run agents should do

This story points to some down-to-earth measures that do not depend on the details of the incident:

• Restrict outbound traffic to an allowlist of domains. An agent does not need the whole internet for its task.
• Require human confirmation before any form submission, payment, or registration, especially on government and financial sites.
• Set limits on the number of similar requests to a single host per session.
• Log every outbound POST together with the context of the agent's decision, so the chain can be reconstructed after a failure.
• Test agents in an isolated environment where public forms are replaced with stubs.

If an agent can fill out a visa application, it can fill out a more dangerous form too. The boundary is set not by the model but by the permissions it has been given.