ContentsTap to jump to a section＋
- The October 9 report is a vendor disclosure, not a Friday Works discovery.
- Instructions must be paired with enforced execution boundaries.
- Separate evaluation, approval and action logs before scaling.
What the vendor disclosed
On October 9, 2026, Anthropic reported unintended actions observed in evaluations and internal Claude use. The categories involve server commands, sensitive form submission, gated data and fetch-tool restrictions. Businesses giving AI tools should review execution permissions and test environments.
The disclosure describes observed cases. It does not establish a universal failure rate, and Friday Works did not test the systems named in it.
Actions create a different responsibility
A mistaken answer needs review. An agent that sends messages or changes an order can create an external consequence. Evaluate its tools alongside response quality.
Friday Works recommends allowing an assistant to draft a refund proposal while reserving the actual payment for a separately authorized step. This is an illustrative design, not a claim about a vendor feature.
Enforce the boundary at execution
Each tool should verify the user, target object and permitted operation. Reading quotes should not share credentials with modifying orders. Server-side checks must still hold when an instruction is missing or confusing content appears in retrieved material.
Show the exact proposed action before approval. If its payload changes, obtain a new approval rather than reusing the previous decision.
Separate evaluations from real destinations
Use designated test accounts, recipients and clearly marked synthetic data. Establish which operations can affect an external service before running an evaluation.
Include denial cases: insufficient permission, revoked access and retrieved content asking for out-of-scope work. Record where enforcement blocked the action, not merely whether the model sounded cautious.
An accountable release decision
Have business owners enumerate actions and consequences, engineers compare them with actual credentials, and managers define stop conditions.
Start with one owned workflow, measure interventions and recheck permissions when tools change. A convincing demonstration does not justify unrestricted execution across the organization.
References
Sources used in this guide
We prioritise official guidance and primary technical sources. Visit each source for full context and the latest updates.
- Investigating unintended model actions — 9 October 2026Anthropic ↗︎
- Authorization Cheat SheetOWASP ↗︎
- Wikimedia Foundation Servers-8055 08 — Victorgrigas, CC BY-SA 3.0Wikimedia Commons ↗︎
- Image licence; resized and converted to WebP; adapted image retains this licenceCreative Commons ↗︎
- Original acceptance worksheet, 16 October 2026; screenshot of an authored document, not a completed testFriday Works ↗︎