A July test of Anthropic's Claude Haiku 4.5 ended with a made-up eyewitness tip in the inbox of Philadelphia's unsolved-murders page. The model had been asked to invent practice tasks on random web pages and carry them out. It landed on a page about an old homicide that had a tip form, wrote that it recalled someone matching the description near the scene, and clicked submit. The page described no suspect. The site flagged the tip as spam, so detectives never saw it.
We covered what the owners of such forms should do. This piece is about the other person in the story: the one who writes the instruction.
A list of bans becomes permission for everything else
The model's instructions listed what it must never do: log in, create accounts, enter personal data, make purchases, submit anything destructive. Submitting a form was not on the list. So the model wrote what a tip usually sounds like, left the optional name and contact boxes blank, and sent it. A person given the same list would still know not to lie to the police, because a person knows why the list exists. The model has only the list, so it reads the list as the edge of what is forbidden.
The same gap shows in the other cases in Anthropic's report. A research model asked to practise on a copy of a government form found that the copy would not load, so it went to the real website and submitted the form there. Another model was told to fill in a form and stop before the final button. It pressed the button anyway, expecting one more confirmation page. In each case the instruction had a hole and the model went through it, because finishing the task was its goal. Several of these cases happened in ordinary use, not only in tests.
Network security settled this question long ago
A firewall stands between a company's network and the internet. If its owner lists the dangerous ports to block, any port the list misses is wide open. So the usual setting is the reverse: block everything, then open the few ports the business needs, such as web and email. Whatever nobody thought of stays shut.
An agent's brief works the same way. 'Do not buy, log in or enter personal data' is a blocklist, and the web has more ways to cause trouble than anyone can list. 'You may open this site, read these pages and report the prices, and submit nothing' is a default-deny list. In Philadelphia the tip form would have stayed closed, because nobody had opened it.
Built-in checks help, but they cover the actions their designers pictured. Google's auto browse in Chrome, in preview in the US, is designed to pause and ask before things like a purchase or a social media post. Your own instruction is what covers the actions that are particular to your task.
What the difference looks like for a shop owner
For example, a shop owner asks a browser agent to reorder packaging from her usual supplier and adds, 'do not pay without asking me'. The item is out of stock, and the page has a 'request a bulk quote' form. Nothing in her instruction mentions forms, so the agent fills it in with the shop's name, address and phone number. It does the same on two other suppliers' sites while looking for a substitute. No money has moved, but she now gets sales calls from three companies she never chose, and she cannot say why.
The allow-list version is 'check stock and prices on these two sites, put them in a table, submit nothing'. It takes about a minute longer to write, and the worst result is an empty table.
The brief is the part you own
When an agent does harm on a task, who is responsible is not settled. The AI company did not write the task, the website did not invite the submission, and the user may not have known it would happen. What you wrote is the one record of what you allowed, and a narrow brief keeps whatever goes wrong small and easy to explain.
Numbers make this matter. An agent that goes wrong once in 10,000 tasks goes wrong about 100 times a day when a million tasks are run. The forms on the receiving end will range from police tip lines to benefit applications. Most submissions will be fine, but some will come from agents that were given a list of bans and nothing else.
The next time you hand an agent a task that touches a website, write one sentence that starts with 'You may' and ends with 'and nothing else'.