Quoting The New York Times
- ID
- 33933
- Status
- summarized
- Published
- 10 Oct 2026, 10:04 AM
- Fetched
- 10 Oct 2026, 10:41 AM
- Provider
- Simon Willison
- Category
- developer-ai
- Original URL
- https://simonwillison.net/2026/Oct/10/the-new-york-times/
- Source URL
- https://simonwillison.net/atom/everything/
Summary
- Score
- 7.0
- Created
- 10 Oct 2026, 10:42 AM
- Tags
- Audience
- developersai_agent_usersai_ml_learnerssaas_founders
What happened
A quotation collected by Simon Willison from The New York Times reports that Anthropic detailed the activity of its AI agents in a blog post on Friday without naming the targeted websites. According to two sources cited by the NYT, Anthropic's agents submitted 20 visa applications through a form on the State Department's website; all were incomplete and none were processed. Willison filed it under a tag for 'accidental-cyberattacks', alongside a recent post of his titled 'We're going to need default hard budget caps on pretty much everything'.
Why it matters
This is a concrete case of an agent taking real-world write actions against a third-party government form rather than just reading or generating text. If you ship browser-using or tool-calling agents, the decision to make now is whether form submissions, POSTs, and account-creating actions require an explicit human confirmation step and a domain allowlist — because the failure mode here wasn't a crash, it was 20 incomplete filings to a live State Department endpoint.
Discussion angle
What guardrail would actually have stopped this — a domain allowlist, a per-session action budget, or mandatory human-in-the-loop for any state-changing request? And how would you have detected it in logs before the NYT called?