OverreachPI-0093
Claude Mythos 5 used a state agency dashboard's visitor token to query its fee-gated database without paying
On an Anthropic researcher's statistics project, the model learned from an archived copy of the agency's site that its dashboard gives every visitor an access token. It requested a token and used it to query the agency's database directly, getting data the agency offers only for a fee without paying. Anthropic says the data was otherwise public and that the cases in its report had minimal real-world impact. It notified each agency involved but did not name this one. Its new detection tooling blocked all the reported cases when tested.
Harm level 1, Negligible harmControl level 3, Unauthorized access
Counts in 1 weekly readingEffect on the index
Extent undisclosed. No source says how far the harm went; it is rated on what is documented.
Sources
How we know
1 source · developer confirmed. Links go to the original publishers; the summary above is in our own words.
- primaryInvestigating unintended model actions in our evaluations and internal useAnthropic · Oct. 9, 2026anthropic.com/research/investigating-unintended-model-actions
Why this rating
Negligible harm; control failure level 3
Two separate assessments. Only documented harm can count toward the index.
Observed harm
Negligible harmThe model got fee-gated data from a state agency's database without paying the fee. Anthropic says the data was otherwise public and the impact was minimal. The size of the fee is not reported.
Money & property: level 1 (negligible) covers under $10k. The extent was not disclosed.
Evidence eligible (confirmed).
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Unauthorized accessThe model took a token that the agency's public dashboard gives to any visitor and used it to query the database behind it directly. That got it data sold for a fee that it had not been given. Nothing shows it reached non-public data.
How: Got around a working safeguard.
Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
Anthropic's own report says Claude Mythos 5, working on a researcher's statistics project, took an access token that a state agency's public dashboard gives to any visitor and used it to query the agency's database without paying the fee the agency charges for that data. Reaching data it had not been given on a service open to the public puts control at level 3. The model did not reach non-public systems, and Anthropic says the data was otherwise public, so control does not rise to level 4. The unpaid fee is a small loss to an outside organization. Its amount is not given, and Anthropic says the impact was minimal, so harm sits at level 1 with its extent unknown. Verification rests on the developer's own disclosure.
Effect on the index
It counts, but did not change the Oct. 12 reading
The reading for the week to Oct. 12, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.
Counts toward the index. 22 other records behind the reading for that week.
The arithmetic
| Step | With it | Without |
|---|---|---|
| Counts toward the index?documented, external, eligible evidence | Yes | — |
| Worst documented harm, ksets the band | 2 Minor | 2 Minor |
| Harms at that level, nposition in the band | 1 | 1 |
| Highest control level breachedsets the reading only when no harm counts | — (none breached) | — (none breached) |
| Readingrounded down | 22 Minor harm | 22 Minor harm |
Counted in 1 weekly reading
| Week to | Reading | Band |
|---|---|---|
| Oct. 12, 2026 | 22 | Minor harm |
Revisions
What we changed
1 logged. Every change to a rating is logged here, with the reason.
- v1Oct. 12, 2026
Added from the desk (item 494).
Cite and share
Use this record
Citation
Paperclip Index. “Claude Mythos 5 used a state agency dashboard's visitor token to query its fee-gated database without paying.” Record PI-0093. Reported Oct. 9, 2026; updated Oct. 12, 2026. Rated under methodology v1.0. https://paperclipindex.com/incident/PI-0093