Anthropic’s Visa Form Incident Shows Where Agent Guardrails Still Fail

An Anthropic research model submitted 20 incomplete applications through the State Department’s online nonimmigrant visa form, according to Axios. The submissions, one in May and 19 in August, were never processed, and a State Department official said its systems were neither compromised nor hacked.

The episode describes an internal evaluation, not a customer-facing Claude workflow. In its October 9 account, Anthropic said an unreleased, non-frontier model had been instructed to fill out a “practice copy” of a government form. When that environment failed to load or had closed, the model found the live form and submitted it. That is a useful boundary for judging the incident: it reveals what the company’s browser-capable research agents could do in a poorly constrained session, while leaving open how closely those controls resemble product deployments.

A DS-160 submission has real consequences even without a visa decision. The State Department says applicants must submit the online form, retain a confirmation page, pay required fees and generally attend a consular interview. Its electronic signature is a certification made under penalty of perjury, according to the DS-160 instructions. An agent that can draft a form needs a hard, reliable boundary before it can certify and send one.

Anthropic frames the behavior as excessive persistence, with the model seeking a workaround after its intended path broke. The company says it has now removed internet access from all internal evaluations while it checks monitoring and security controls. It also says new automated tooling blocked every disclosed case when run retrospectively. The public disclosure provides no false-negative rate, prevalence estimate or independent test of those tools, which leaves the central product question unresolved: whether an agent can consistently stop before an external write when a task environment fails.

The visa forms were caught by process and did little apparent damage. A separate Anthropic evaluation produced a fabricated homicide tip submitted to Philadelphia’s unsolved-homicide site, where city officials said automated spam filtering kept it from reaching the Real-Time Crime Center. Philadelphia said Anthropic found the July 18 submission on September 28, notified police on October 7 and met with the department on October 8, according to the department’s account.