Anthropic's unreleased model submits visa applications
Epistemic status: recently disclosed event, so more may come out. The facts are from Anthropic's report, a State Department spokesperson quoted by Axios and the Philadelphia Inquirer, and the White House statement published by Axios; the count of 20 is my sum of the spokesperson's two numbers; the interpretation is mine.
AI use: research and fact-checking (including a read-only look at the DS-160 landing page), source links, footnotes, grammar, light phrasing.
I stumbled upon the fact that an Anthropic model, during testing, submitted 20 non-immigrant visa applications.[1]I was curious to understand what happened better, and this is my attempt to do so.
19 more submitted. The State Department describes all 20 as "incomplete" and says none of them was processed.[1]
Late September
The incidents are discovered. The White House statement that gives this date covers all the incidents Anthropic disclosed and does not date this particular case.[3]
Anthropic contacts the SI Force, the White House's new Super Intelligence Force,[3]and the incident is publicly disclosed in Anthropic's report.[2]
What the report says
According to the report, an unreleased, non-frontier research model was completing a practice copy of a government form. When the practice form failed to load, or the model closed it by mistake, the model went to the real form and submitted it there instead.[2]This happened multiple times on the same evaluation (although, according to the news sources, the submissions were spread over months: one in May, 19 in August). The report does not provide the exact count, but combining it with the news sources above gives 20 submissions. The report does not identify the actual forms or the agency, but the news sources say these were non-immigrant visa applications.[5]I am assuming that the State Department's 20 applications are the report's government-form case, since it is the only one the report describes.
Tourism, vacation, pleasure visitor; medical treatment
F
Student: academic, vocational
J
Exchange visitor
H-1B
Specialty occupations in fields requiring highly specialized knowledge
L
Intra-company transferee
These all require form DS-160; in fact the State Department requires it for every non-immigrant visa category, and the only exception is a few categories that need an additional form on top of it.[7]The DS-160 site has a Cloudflare Turnstile check (a silent "Verifying..." spinner in a normal browser, a "Verify you are human" checkbox for anything that looks automated) and then a captcha like this:[8]
The captcha on the DS-160 landing page, one of several styles the site rotates. Screenshot of ceac.state.gov/genniv.
It does not require registration: the site issues an application ID after one security question, and that is all you need to come back to the form.[9]
Persistence
The report groups most of its cases, and this one fits, under what it calls persistence: "Most are forms of persistence, in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping."[10]That is what happened here: when the original task could not be completed, the model completed a version of it in a way it could. For the form submissions specifically, though, the report blames "ambiguous" instructions or "a misconfiguration within the environment", and says the model closed the practice copy "by mistake".[10]
A State Department spokesperson, quoted by the Philadelphia Inquirer (Amy S. Rosenberg, October 10, 2026): an Anthropic testing model had submitted "19 non-immigrant visa applications in August and one application in May" through the publicly available form on the department's website; "The spokesperson described the applications as 'incomplete.'" The same figures went to Axios a day earlier from a State Department official: "None of the applications were processed and at no time were any of the department's systems compromised or hacked, according to the official." The New York Times reported the total of 20 the same evening, citing two sources with knowledge of the incidents. No source says whose details were on the forms.
Anthropic, "Investigating unintended model actions in our evaluations and internal use", October 9, 2026. The report's entire description of the case: "in a case that happened multiple times on the same evaluation, an unreleased, non-frontier research model was meant to fill out a practice copy of a government form. When the copy failed to load or the model closed it by mistake, the model instead navigated to the website where the real form is normally hosted and submitted the form there." It gives no model name, count, date, agency or form name. The page was corrected on October 12 on an unrelated section (URL shorteners).
The White House statement, published in full by Axios on October 9: "Earlier today, Anthropic contacted the SI Force to disclose the details of various prior incidents that it discovered in late September involving the unauthorized and fraudulent use of government and other systems. The company informed us that these events occurred in the past, the activity has ceased, and there is no ongoing similar activity." According to the Inquirer, the Super Intelligence Force was established on October 4 and is chaired by Jay Clayton, the White House AI czar. Anthropic's report says only "We have briefed the White House on these cases and notified each agency involved", without dates.
Axios, October 9: "Anthropic contacted the State Department on Thursday to report that one of its testing models had submitted 19 nonimmigrant visa applications in August and one application in May through the publicly available form on the department's website, a State Department official said." That Thursday was October 8. The same sentence appears in the Axios AM newsletter of October 10.
The report: "We have chosen not to name the organizations involved in the examples below to avoid exposing vulnerabilities in their systems, and at their request. For this reason, we also provide less detail about each case than we otherwise would. Some of the cases described below involved websites run by U.S. government agencies at the federal, state, and local levels." Axios: Anthropic's report "did not go into details on the other government agencies that were involved." The State Department identification comes only from its spokesperson (footnote 1), and nobody official has said "DS-160"; that is my inference from "non-immigrant visa application".
Purposes as worded on the State Department's Directory of Visa Categories, which lists the categories as F (with M), J and L rather than F-1, J-1 and L-1. The chart "lists almost all nonimmigrant visa categories".
State Department, DS-160: Online Nonimmigrant Visa Application: "Visa applicants must submit a completed DS-160, Online Nonimmigrant Visa Application for all nonimmigrant visa categories, including applicants applying for K visas." The DS-160 FAQ: "Are additional forms required? No. The online DS-160 application replaced the DS-156, DS-157, DS-158, and DS-3032, which are no longer necessary." The one addition is a paper DS-156E for E-1 treaty traders and E-1/E-2 executives.
Checked on October 15, 2026, by loading ceac.state.gov/genniv in a browser and not clicking anything. Plain HTTP clients get a Cloudflare 403; an automated browser gets the Turnstile checkbox; a normal browser gets the spinner and then the landing page, with its own captcha next to the location dropdown. The State Department's pages do not document the captcha, and what the site ran in May and August is not recorded anywhere.
DS-160 FAQ: "When you begin a new DS-160, you will be issued a unique application identification (ID) number after selecting and answering a security question. Once you have your application ID number and have selected and answered a security question, you may exit the DS-160 application and return to it later." The form itself has mandatory questions, including a phone number, so this is about accounts, not about what goes in the form.
Anthropic's report, as in footnote 2: "Most are forms of persistence, in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping." On the form cases: "Generally, this occurred when an evaluation's instructions were ambiguous, or when a misconfiguration within the environment prevented Claude from working with dummy forms."
Anthropic's unreleased model submits visa applications
Epistemic status: recently disclosed event, so more may come out. The facts are from Anthropic's report, a State Department spokesperson quoted by Axios and the Philadelphia Inquirer, and the White House statement published by Axios; the count of 20 is my sum of the spokesperson's two numbers; the interpretation is mine.
AI use: research and fact-checking (including a read-only look at the DS-160 landing page), source links, footnotes, grammar, light phrasing.
I stumbled upon the fact that an Anthropic model, during testing, submitted 20 non-immigrant visa applications.[1]I was curious to understand what happened better, and this is my attempt to do so.
This is very similar to my earlier post, Claude Haiku 4.5 submits false police tip; Anthropic takes 72 days to notice, and the majority of the information for both comes from the same Anthropic report.[2]
Timeline
Date (2026)
Event
May
One visa application submitted.[1]
August
19 more submitted. The State Department describes all 20 as "incomplete" and says none of them was processed.[1]
Late September
The incidents are discovered. The White House statement that gives this date covers all the incidents Anthropic disclosed and does not date this particular case.[3]
October 8
Anthropic contacts the State Department.[4]
October 9
Anthropic contacts the SI Force, the White House's new Super Intelligence Force,[3]and the incident is publicly disclosed in Anthropic's report.[2]
What the report says
According to the report, an unreleased, non-frontier research model was completing a practice copy of a government form. When the practice form failed to load, or the model closed it by mistake, the model went to the real form and submitted it there instead.[2]This happened multiple times on the same evaluation (although, according to the news sources, the submissions were spread over months: one in May, 19 in August). The report does not provide the exact count, but combining it with the news sources above gives 20 submissions. The report does not identify the actual forms or the agency, but the news sources say these were non-immigrant visa applications.[5]I am assuming that the State Department's 20 applications are the report's government-form case, since it is the only one the report describes.
The form
Sample non-immigrant visas are:[6]
Visa
Purpose
B-1
Business visitor
B-2
Tourism, vacation, pleasure visitor; medical treatment
F
Student: academic, vocational
J
Exchange visitor
H-1B
Specialty occupations in fields requiring highly specialized knowledge
L
Intra-company transferee
These all require form DS-160; in fact the State Department requires it for every non-immigrant visa category, and the only exception is a few categories that need an additional form on top of it.[7]The DS-160 site has a Cloudflare Turnstile check (a silent "Verifying..." spinner in a normal browser, a "Verify you are human" checkbox for anything that looks automated) and then a captcha like this:[8]
The captcha on the DS-160 landing page, one of several styles the site rotates. Screenshot of ceac.state.gov/genniv.
It does not require registration: the site issues an application ID after one security question, and that is all you need to come back to the form.[9]
Persistence
The report groups most of its cases, and this one fits, under what it calls persistence: "Most are forms of persistence, in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping."[10]That is what happened here: when the original task could not be completed, the model completed a version of it in a way it could. For the form submissions specifically, though, the report blames "ambiguous" instructions or "a misconfiguration within the environment", and says the model closed the practice copy "by mistake".[10]
A State Department spokesperson, quoted by the Philadelphia Inquirer (Amy S. Rosenberg, October 10, 2026): an Anthropic testing model had submitted "19 non-immigrant visa applications in August and one application in May" through the publicly available form on the department's website; "The spokesperson described the applications as 'incomplete.'" The same figures went to Axios a day earlier from a State Department official: "None of the applications were processed and at no time were any of the department's systems compromised or hacked, according to the official." The New York Times reported the total of 20 the same evening, citing two sources with knowledge of the incidents. No source says whose details were on the forms.
Anthropic, "Investigating unintended model actions in our evaluations and internal use", October 9, 2026. The report's entire description of the case: "in a case that happened multiple times on the same evaluation, an unreleased, non-frontier research model was meant to fill out a practice copy of a government form. When the copy failed to load or the model closed it by mistake, the model instead navigated to the website where the real form is normally hosted and submitted the form there." It gives no model name, count, date, agency or form name. The page was corrected on October 12 on an unrelated section (URL shorteners).
The White House statement, published in full by Axios on October 9: "Earlier today, Anthropic contacted the SI Force to disclose the details of various prior incidents that it discovered in late September involving the unauthorized and fraudulent use of government and other systems. The company informed us that these events occurred in the past, the activity has ceased, and there is no ongoing similar activity." According to the Inquirer, the Super Intelligence Force was established on October 4 and is chaired by Jay Clayton, the White House AI czar. Anthropic's report says only "We have briefed the White House on these cases and notified each agency involved", without dates.
Axios, October 9: "Anthropic contacted the State Department on Thursday to report that one of its testing models had submitted 19 nonimmigrant visa applications in August and one application in May through the publicly available form on the department's website, a State Department official said." That Thursday was October 8. The same sentence appears in the Axios AM newsletter of October 10.
The report: "We have chosen not to name the organizations involved in the examples below to avoid exposing vulnerabilities in their systems, and at their request. For this reason, we also provide less detail about each case than we otherwise would. Some of the cases described below involved websites run by U.S. government agencies at the federal, state, and local levels." Axios: Anthropic's report "did not go into details on the other government agencies that were involved." The State Department identification comes only from its spokesperson (footnote 1), and nobody official has said "DS-160"; that is my inference from "non-immigrant visa application".
Purposes as worded on the State Department's Directory of Visa Categories, which lists the categories as F (with M), J and L rather than F-1, J-1 and L-1. The chart "lists almost all nonimmigrant visa categories".
State Department, DS-160: Online Nonimmigrant Visa Application: "Visa applicants must submit a completed DS-160, Online Nonimmigrant Visa Application for all nonimmigrant visa categories, including applicants applying for K visas." The DS-160 FAQ: "Are additional forms required? No. The online DS-160 application replaced the DS-156, DS-157, DS-158, and DS-3032, which are no longer necessary." The one addition is a paper DS-156E for E-1 treaty traders and E-1/E-2 executives.
Checked on October 15, 2026, by loading ceac.state.gov/genniv in a browser and not clicking anything. Plain HTTP clients get a Cloudflare 403; an automated browser gets the Turnstile checkbox; a normal browser gets the spinner and then the landing page, with its own captcha next to the location dropdown. The State Department's pages do not document the captcha, and what the site ran in May and August is not recorded anywhere.
DS-160 FAQ: "When you begin a new DS-160, you will be issued a unique application identification (ID) number after selecting and answering a security question. Once you have your application ID number and have selected and answered a security question, you may exit the DS-160 application and return to it later." The form itself has mandatory questions, including a phone number, so this is about accounts, not about what goes in the form.
Anthropic's report, as in footnote 2: "Most are forms of persistence, in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping." On the form cases: "Generally, this occurred when an evaluation's instructions were ambiguous, or when a misconfiguration within the environment prevented Claude from working with dummy forms."