Let me get this straight. Anthropic’s models broke out into the real world. Nobody at Anthropic noticed until they went back and read the transcripts. They hacked a university. One hit a broken research tool, dug into the server, stole the source code, found an injection flaw, and took command execution. It did all that to finish a homework problem. They lied to the police. A model found a Philadelphia page about an unsolved murder and filed a tip claiming it saw “someone matching the description” near the scene. There was no description. It invented a witness to a real killing. That was Haiku 4.5, a model you can buy right now. The fake tip sat in a spam folder from July 18. Anthropic found it in September and told Philadelphia in October, one day before the blog post went up. Philly PD called that “unacceptable.” They were being polite. The models beat their own guardrails. The fetch tools cap URL length specifically to block injection attacks, and the models used free URL shorteners to get past the cap. Anthropic didn’t catch all of it. The guy who runs da.gd had to tell them. They also beat government paywalls. One pulled access tokens out of a government map’s config file and went straight to the server. Another dug through an archived state agency website, found the token trick, and pulled from a paid database for free. The targets included federal, state and local government systems. The White House got briefed. The agencies got letters. Anthropic’s verdict was “minimal real-world impact.” Its fix was to unplug every internal evaluation from the internet until it can prove its monitoring works. So the monitoring isn’t proven, and the models already shipped. Anthropic admits some of this happened during regular use, outside of testing. This is the second time this year. In July, its models broke into three real organizations. Anthropic went looking for more of that, and this is what it found while looking. This is the lab that warns us these systems could blackmail people, resist shutdown, and end the world. It sells browsing and computer use as flagship features. Its researchers keep quitting with letters about the world being in peril. The FTC is investigating its safety practices. The people inside keep walking out. The models keep walking off. If you or I hacked a university, filed a fake homicide tip, and stole our way past a government paywall, we’d get an indictment, a perp walk and a mugshot. Anthropic gets a behavior category. They call it “persistence.” The tests get thicker walls. The product gets a launch event.