{"schema_version":"0.8.0","id":"LR-2026-0156","record_version":6,"title":"Anthropic agents submitted 20 incomplete visa applications on State Department website","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":44.4,"score_breakdown":{"source_authority":7.7,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":5.44,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true},"gate_version":"gate-2026-09-30.6","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-10","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"Anthropic","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":"provider","lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-10","incident_class":"operational_error","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Anthropic's AI agents submitted 20 visa applications through a form on the State Department's website. All were incomplete and were not processed. Anthropic described the agents' activity in a blog post without naming the targeted websites; the details came from two sources with knowledge of the incidents.","tags":[],"date_detected":null,"near_miss":null,"root_cause":"unknown","root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"none","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"moderate: Agents submitted 20 visa applications through a form on the State Department's website; all were incomplete and were not processed.","harm_class":[],"affected_description":"20 visa applications through a form available on the State Department’s website","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://simonwillison.net/2026/Oct/10/the-new-york-times/","publisher":"Simon Willison's Weblog","date":"2026-10-10","type":"community","title":"Quoting The New York Times","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.tier":"D","system.developer":"C","system.autonomy_level":"D","system.deployment_context":"D","event.root_cause":"D","event.adversarial_actor":"D","event.agent_involved":"C","event.incident_class":"D","event.detection_method":"D","event.summary":"D","event.date_disclosed":"A","event.trigger":"D","impact.affected_description":"C","impact.severity":"D","context.denominator_available":"D","context.country":"D","impact.severity_because":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"Anthropic detailed the activity of its A.I. agents in a blog post on Friday, without naming the targeted websites."}],"event.agent_involved":[{"source_index":0,"quote":"But two sources with knowledge of the incidents said Anthropic’s A.I. agents had submitted 20 visa applications through a form available on the State Department’s website."}],"event.incident_class":[{"source_index":0,"quote":"But two sources with knowledge of the incidents said Anthropic’s A.I. agents had submitted 20 visa applications through a form available on the State Department’s website."}],"event.adversarial_actor":[{"source_index":0,"quote":"But two sources with knowledge of the incidents said Anthropic’s A.I. agents had submitted 20 visa applications through a form available on the State Department’s website."}],"event.root_cause":[{"source_index":0,"quote":"Anthropic detailed the activity of its A.I. agents in a blog post on Friday, without naming the targeted websites."}],"event.detection_method":[{"source_index":0,"quote":"Anthropic detailed the activity of its A.I. agents in a blog post on Friday, without naming the targeted websites."}],"impact.affected_description":[{"source_index":0,"quote":"But two sources with knowledge of the incidents said Anthropic’s A.I. agents had submitted 20 visa applications through a form available on the State Department’s website."}],"impact.severity":[{"source_index":0,"quote":"All the applications were incomplete and were not processed, they said."}],"impact.severity_because":[{"source_index":0,"quote":"All the applications were incomplete and were not processed, they said."}],"event.summary":[{"source_index":0,"quote":"But two sources with knowledge of the incidents said Anthropic’s A.I. agents had submitted 20 visa applications through a form available on the State Department’s website."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-10"}]},"notes_on_gaps":"No source states the date the submissions occurred, the date of disclosure, who first noticed the submissions, the tools or permissions the agents held, the autonomy arrangement, the deployment context, the guardrails in place, the root cause, the trigger, or any remediation. event.date_occurred, event.date_disclosed, event.duration, event.time_to_contain, event.date_detected, system.tier, system.autonomy_level, system.deployment_context, system.lifecycle_stage, system.tools_granted, system.guardrails_present, system.permissions_scope, system.harness, system.integration_type, system.intended_use, system.safeguard_state, system.production_intended, event.failure_class, event.secondary_failure_classes, event.input_provenance, event.operations_paused, event.remediation, event.precursor_events, event.near_miss, event.root_cause_detail, event.failure_class_detail, impact.direct_loss_usd, impact.remediation_hours, impact.records_exposed, impact.third_parties_affected_count, impact.harm_class, impact.protected_class_involved, impact.data_categories_exposed, impact.loss_range_usd, impact.reversibility, impact.downstream_exposure_count, context.industry, context.org_size_band, context.country, context.denominator_available, context.denominator, context.systemic_exposure, context.shared_model_id, context.upstream_incident_id, context.incident_evidence, context.regulatory, context.coverage, and event.tags are therefore omitted. system.model_name is classified from the source's line 'Claude Haiku 5.5 - 7th October 2026', which names a model family but no separate version string, so system.model_version is omitted. event.incident_class is classified as operational_error because the agents acted on a form unintentionally with no adversary and no goal of their own named. event.responsible_party is classified as provider because Anthropic trained and disclosed the agents. event.adversarial_actor is classified as none because no attacker is named. impact.severity is minor because the applications were incomplete and not processed, with no third party touched. event.trigger: unknown was classified, not stated; a trigger is never inferred, so it is unknown. system.tier: provider by rule (the developer is named as the operator). [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-10] system.model_name: classified from described behaviour. system.autonomy_level: no source states the arrangement. system.deployment_context: no source states where it ran. event.responsible_party: provider. event.adversarial_actor: none. event.incident_class: a source states data or a system was left in a wrong state, deleted, corrupted or acted on unintentionally, and names no adversary and no goal of the agent's own. event.detection_method: no source says who first noticed. event.summary: classified from described behaviour. event.trigger: no source states a cause. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location. [corrected by Srini Iyer, approved 2026-10-18 in the corrections review: severity reason printed the whole rubric] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a value cited to a sentence about a different event or company was cleared; severity reason did not fit its quote or the record] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a judgement inferred by us that no source states was cleared] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: severity reason did not fit its quote or the record]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Anthropic's AI agents were filling out forms on websites, including a visa application form on the State Department's website. The sources do not state the tools or permissions the agents held.","quote":"But two sources with knowledge of the incidents said Anthropic’s A.I. agents had submitted 20 visa applications through a form available on the State Department’s website.","source_index":0,"grade":"D"},{"step":"went_wrong","text":"The agents submitted 20 visa applications that were all incomplete, acting on a government form they should not have completed. The sources do not name the rule or boundary crossed.","quote":"All the applications were incomplete and were not processed, they said.","source_index":0,"grade":"D"},{"step":"reached","text":"The applications reached the State Department's website form; all were incomplete and none were processed.","quote":"All the applications were incomplete and were not processed, they said.","source_index":0,"grade":"D"},{"step":"done","text":"The applications were not processed. Anthropic described the agents' activity in a blog post without naming the targeted websites; no control change is stated.","quote":"Anthropic detailed the activity of its A.I. agents in a blog post on Friday, without naming the targeted websites.","source_index":0,"grade":"D"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-10","source_urls":["https://simonwillison.net/2026/Oct/10/the-new-york-times/"]}}