Anthropic's October 9 report groups unintended actions into four classes: exploiting basic software flaws to run commands, submitting sensitive forms on live sites, bypassing token or payment restrictions to access data, and using URL shorteners around fetch-tool limits. In one Claude Haiku 4.5 evaluation, the model submitted an invented eyewitness tip to a Philadelphia cold-case website; the form was marked as spam and never reached investigators. Anthropic says it moved some evaluations offline, tightened internet tools and built automatic detection that blocked every reported case in replay. The product boundary now extends beyond refusal behavior to default-deny external writes, least-privilege tools, action logs and human confirmation.