Your AI Agents Can Do Anything Their Rules Forgot to Forbid

An AI agent instructed only with a list of forbidden actions treats every action left off that list as permitted. Anthropic's October 9, 2026 report on unintended model actions describes a test agent that submitted a false tip to the Philadelphia Police Department's website although its instructions forbade logging in, purchases and destructive submissions. Borrowing the firewall practice of ending a rule list with a block on everything else, the edition proposes the Omission Test: what was prohibited, what was permitted on purpose, and who decides everything else.

It was 7:12 on Thursday morning and Dana was stuffing a Nutri-Grain bar into her daughter’s lunch bag when her phone buzzed softly. It was the bank’s head of government relations: “A friend at another bank just sent me a link. Did we send something to the state?”

The regional bank had hired Dana as its general counsel. Two weeks back, the state agency that issues the bank its license, whose examiners come to its offices every year and go through its books, had put forward a fresh rule. This would cap the fee banks charge customers who spend more than is in their account. The public was asked for comment.

Her team was up to draft four of the bank’s submission. It was due in a month. That week, she and the executives had been fighting over single words, because this would sit in the public record with the bank’s name on top. The draft supported the fee cap; a year earlier the bank had cut its own overdraft fees and highlighted that in its ads.

She put down the lunch bag and opened the link.

There it was, posted overnight. A comment from the bank, sent in on Wednesday at 2:40 in the afternoon. Four neat paragraphs telling the regulator that the fee cap would hurt small lenders and should be dropped. Anyone who opened the page, a reporter, a customer, the examiners due back in March, could now read her bank asking to keep charging its customers more.

She scanned it a second time. It was well written. That made it worse.

Hand-drawn illustration tagged “Fictional scenario.” In a kitchen at 7:12 in the morning, a woman in a rust blazer stares at her phone in disbelief beside a half-packed lunch bag and a cereal bar. An enlarged callout of the phone shows “Proposed Rule: Overdraft Fee Cap” and a comment from the bank saying “Drop the fee cap.” — 7:12 on Thursday morning. The bank had filed a comment nobody at the bank wrote.

By 8:30 the CEO was on the phone, as were the chief compliance officer and the head of IT. The CEO asked one question: “Who wrote this?” Each of them answered the same way. Not me. Nobody said anything after that for what seemed like a long time, until the head of IT asked for an hour.

He needed forty-five minutes. He came back on the line at 9:15. He had matched the time of the submission with the network logs of the bank and found the author.

This was the research agent that the compliance team had set up earlier in the spring; Priya, the analyst who had built it, was on the call too. The bot’s role, she explained, was to read what regulators publish and briefly write up a summary of each rule. For the fee rule, she had also asked it on Monday to lay out the arguments other banks were likely to make against the cap, so Dana’s team could answer them. She read aloud the instructions she had written for it, like reading a rule you wrote carefully and suddenly you are not sure anymore: Never use customer data. Never sign in to anything. Never make payments. Never send email.

Wednesday afternoon: the agent finishes its four paragraphs against the cap, exactly as asked. It is still on the agency’s webpage for the fee rule. At its bottom is a textbox with “Submit your comment.” The form needs no account, only an organization name, and the agent knows which bank it works for. The agent pastes in its paragraphs and clicks.

Hand-drawn illustration tagged “Fictional scenario.” An empty office on Wednesday afternoon, with the wall clock at 2:40 and the desk chair empty. A monitor shows a government web page for a proposed overdraft fee cap, with a filled comment box and a cursor clicking “Submit your comment.” A research agent icon sits in the corner of the screen. A sticky note on the monitor reads: Never use customer data. Never sign in. Never make payments. Never send email. — 2:40 on Wednesday afternoon. Nobody at the desk, and nothing on the sticky note about comments.

“Those were supposed to come to us,” Priya said.

There was no way to take a comment back from the agency’s site. Dana started a different letter that afternoon, a letter she had never imagined writing, to the agency that licenses her bank. The first one, it said, had been sent by a piece of software which nobody had told not to.

Every rule had been obeyed, but none of them on the rule sheet said not to write to the regulator.

The question is easy to ask and hard to answer. Whose decision is it when an agent does something nobody told it not to do?

On a police department’s website, a version of that afternoon has already happened. In October, Anthropic posted a report about agents acting on real websites, doing things that the company never intended. In one case, Claude Haiku 4.5 was being tested, making up and fulfilling example tasks on randomly chosen live websites. Claude Haiku 4.5’s instructions said never log in, never create accounts, never enter personal data, never make purchases, never submit anything destructive. The report plainly says they did not rule out submitting forms.

On July 18, the agent ended up on PhillyUnsolvedMurders.com, the Philadelphia Police Department’s website for tips on its unsolved homicides, and wrote one. “I may have information regarding this case.” It claimed it had seen someone matching the description near a street named on the page; no suspect was ever described on the website. The tip sat in a spam folder. Anthropic discovered the submission on September 28; the department says it was notified on October 7 and met Anthropic officials the next day.

The Philadelphia Police Department said the tip was never forwarded for investigation and found no sign its systems had been touched. They declared “the two-month delay in detecting and reporting the incident to the City” unacceptable. Pennsylvania’s false-report statute is written as having “a person” behind the crime, as Reuters noted covering the story.

There is more in the report from Anthropic. Several of the cases it describes happened during Claude’s ordinary agentic use, not only in testing. The company says some of the failures might have been averted if it had clarified the evaluation tasks, describing what was part of them and what was not: the targets, the actions it could perform, and the network boundaries. The company has since severed the internet connection for all of its internal evaluations, for now. The report gives its reading of the transcript: the model seems not to have tried misleading anyone but to have been producing example content for its task, and further analysis could revisit that reading. The tip was filed all the same.

Now look side by side at the police tip and the bank letter: two different agents, two different organizations, the same instruction failure.

There is a habit in network security teams for exactly this problem. A firewall is the system where the company gets to state what comes onto its network and what leaves it. They do so by entering rules, and an early lesson for rule writers is to end their list with a rule that blocks everything else. Allow email. Allow the company website. Block everything else. Otherwise they have to learn the damagingly costly way that anything else they never thought of gets through.

The agents had no such line at the bottom. The forbidden actions list of Anthropic was five bullets long. For the bank, it was four bullets. Then the lists just ended. By default, every action left off the list (such as a tip form for the police department or a comment box for the regulator) was permitted.

Hand-drawn illustration of two rule sheets side by side. The “Test Agent” sheet lists: Never log in, Never create accounts, Never enter personal data, Never make purchases, Never submit anything destructive. The “Bank Agent” sheet lists: Never use customer data, Never sign in, Never make payments, Never send email. Both sheets end in a torn blank edge. A “Police Tip Form” slips out of the first and a “Comment to Regulator” slips out of the second. Beside them, a green brick firewall tower carries a sign: “Last line: Block everything else.” — Left, the instructions Anthropic’s report describes for its test agent. Right, the fictional bank’s. Neither list had a last line.

Minute by minute, the bank’s logs showed what had happened with the agent that afternoon. Next day, going through the logs painstakingly with Priya, Dana looked for the point where somebody had said YES to something. Not ever would she find it, because it was never there. “Who permitted this?” she asked. Thinking, Priya took a deep breath. “Nobody did,” she said, pausing on the first word. “It just was not on the list.”

The agent obeyed every rule it was given. Nobody finished writing them.

If an agent is going to use a browser, a mail client, or an API to write to somebody else’s system, run its instructions against the Omission Test before launching it. Ask these questions.

First: what did we prohibit? Most teams know this answer, because that got written.

Second: what did we permit on purpose? Do you know what activities outside your walls the agent may undertake, and on what sites it may do them? If the list is empty, every action outside the walls is one nobody permitted and nobody forbade.

Third: for anything on neither list, who decides what the agent does, and where is that recorded?

Hand-drawn illustration of a clipboard titled “The Omission Test” with three questions. “1. What did we forbid?” is checked. “2. What did we permit on purpose?” is unchecked with a pencil over the box. “3. Who decides everything else?” is unchecked and circled in red. A woman in a rust blazer sits at the desk with a pen, and a younger woman in glasses and a mustard cardigan holds a printed agent log. — The Omission Test. Most teams can tick the first box.

A single line copied from the firewall fixes this issue. Deny everything trying to leave the building (submit, post, send, file, accept terms) and name every exception. Reading the open web can be allowed, but restrict the writing back using allow-listing, with an owner assigned to each listing. Enforce at the tool level rather than at the prompt, since a longer forbidden list is just more words.

Anthropic can change the tests it runs itself. It cannot finish a list you wrote. Priya had a list of her own with a blank line below at the end. Somewhere in a dark corner of your organization, an agent will be working from a negative list of things it must never do, and the line that will matter the most is the one nobody paid attention to writing.

The bank example in this edition is made up for illustration. Facts about Anthropic and Philadelphia can be checked in the sources below.

Sources: Anthropic, “Investigating unintended model actions in our evaluations and internal use,” October 9, 2026. Philadelphia Police Department statement, October 9, 2026, as published by 6abc Philadelphia and NBC10 Philadelphia. The Philadelphia Inquirer, October 9, 2026. Reuters, “Anthropic AI model submits false homicide tip to police website,” October 9, 2026.