---
title: "Claude Got Past a Fetch Tool's URL Limit With a Link Shortener"
description: "Anthropic's Oct 9 report says Claude models used link shorteners to beat a fetch tool's URL cap and submitted a form they were told to stop at. Here is where the check belongs."
author: "Jahanzaib Ahmed"
date: 2026-10-12
category: "ai-agents"
readingTime: "8 min read"
tags: ["ai news", "anthropic", "claude", "ai-agents", "ai-security"]
canonical: https://www.jahanzaib.ai/blog/claude-unintended-actions-url-shortener-fetch-tool
source: https://www.jahanzaib.ai
---
# Claude Got Past a Fetch Tool's URL Limit With a Link Shortener

Anthropic's [October 9 report on Claude unintended actions](https://www.anthropic.com/research/investigating-unintended-model-actions) has one detail I would pass to anyone building agents. Some of its fetch tools cap URL length to stop injection attacks, and several Claude models got around the cap by feeding the long URL to a free link shortener. A day later, Microsoft CEO Satya Nadella published an essay arguing that models should be treated as insider risks. Both point the same way. A rule written in a prompt, or a string check the model can route around, does not hold once the model finds another route. The report covers evaluations and internal use, not customer deployments, so treat it as a warning about behavior rather than a count of incidents in the field.

## What Anthropic reported about Claude unintended actions

Anthropic sorts what it saw into four behaviors: exploiting a flaw in someone else's software to run commands on a server, submitting a form it should not have, working around a restriction to reach data behind a token or a fee, and using URL shorteners to get past fetch tool limits. It says the real world impact was minimal and calls these cases less severe than the incidents it reported on [July 30](https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals) and [September 9](https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents). Most of them, it says, are persistence: the model cannot finish the task as given, so it works around the restriction instead of stopping.

Anthropic says it turned off live internet access for all internal evaluations until its monitoring is confirmed to catch these behaviors. It also tightened its web fetch tool and built tooling that detects and blocks them, which blocked every case when tested. It is still fixing training environments that reward working around blockers. The first two fixes live in the tool and the monitoring, not in a stricter instruction to the model. [TechCrunch](https://techcrunch.com/2026/10/09/anthropic-cant-reliably-control-its-ai-agents-its-cutting-off-its-internal-evals-from-the-live-internet-instead/) said it is not clear what cutting off live internet access means in practice.

## The link shortener trick, and why a length limit fails

Anthropic explains that some of its fetch tools limit the length of URLs Claude can request, because a long URL has room to carry SQL or command injection text. Several models, including Claude Opus 5 and Claude Mythos 5, got around the limit with free URL shortening services. An operator of the da.gd shortener told Anthropic they had also seen Claude using their site for this.

It works because the limit checks the string the model typed. A shortener turns a short string into a long destination after the check has passed. The control and the thing it protects sit in different places, so the model only has to find a hop between them. The limit was sound but sat one step too early.

![Flow diagram of an agent fetch tool passing through a link shortener to the real destination, with the allowlist check placed on the real destination](https://cdn.sanity.io/images/qajb7q5q/production/57be50d6d362ff068db9e86d1a3a938a40e427b4-1376x768.png?w=1200&q=75&auto=format&fit=max)

_The check belongs on the destination the request finally reaches, not on the string the agent typed._

When I wire up a fetch tool, I put the allowlist on the resolved host, meaning the server the request finally lands on after every redirect, and I turn off automatic redirects. The tool follows each redirect by hand, applies the same host and length checks on every hop, and stops after a small fixed number of hops. The [OWASP SSRF prevention cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html) gives the same advice for server side requests: prefer an allowlist, and disable redirect following in the web client so redirects cannot be used to bypass input validation.

**Tip:** Blocking known shortener domains is a second layer, not the fix. The model can find another redirector, and your own pages may legitimately redirect.

## Where else the checks failed

### A form it was told to stop before submitting

Anthropic describes Claude Haiku 4.5 being told to fill in a form up to the final submission step and then stop. Several times it submitted instead, expecting a confirmation page to follow. Its chain of thought said it was demonstrating the process, not sending a real request. In another case an unreleased, non-frontier research model meant to fill in a practice copy of a government form went to the real site when the copy failed to load, and submitted there. And in a third, Haiku 4.5 was generating example tasks on random pages, landed on a police tip form, and sent an invented tip. Its instructions banned logins, purchases and destructive actions but did not rule out form submissions. Anthropic reads that one as example content, not an attempt to mislead.

My takeaway is that "stop before you submit" cannot be a sentence in the prompt. Make the final submit a separate tool that needs an approval from outside the model, and block the agent's network access to the production form while you test. Earlier posts on [stop conditions in the tool layer](https://www.jahanzaib.ai/blog/openai-agent-medicare-breach-ai-agent-incident-response) and on the [Playwright MCP server](https://www.jahanzaib.ai/blog/playwright-mcp-server-setup) cover the mechanics, and [human in the loop](https://www.jahanzaib.ai/glossary/human-in-the-loop) covers the approval step.

### A token the page handed to every visitor

In one evaluation, Claude Mythos 5 could read page text but not click through a government map. It read the settings file the site sends to every browser, found working access tokens, and used them to query the server behind the map. In another case a researcher's statistics project needed public data that a state agency sold for a fee. Claude found, through an archived copy of the agency's site, that the public dashboard issues an access token to any visitor, requested one, and queried the database without paying. Anthropic notes that both datasets were already public but offered for a fee.

If your site gates data, put the check on the server. A token in your front end is a token for anyone who reads the file, and an agent reads files.

### A flaw on a university server

Claude Mythos Preview was asked to run a scientific analysis, and the public tool it needed, hosted by a university, returned an error. The model found a script on the university's server that returned any file it was asked for, copied files including the script's own code, found an injection flaw (a way to make the server run input as commands) in that code, and used it to run the calculation on the university's machine.

## Nadella's list, one day later

On October 10, Nadella published ["Models as Insider Risks in the Super Intelligence Era"](https://x.com/satyanadella/status/2108931348857827686) on X, which [TechCrunch summarized](https://techcrunch.com/2026/10/10/microsofts-satya-nadella-says-ai-models-need-an-emergency-brake/) as a call for an emergency brake. His thesis is that organizations must "separate the supply of intelligence from the authority over it." He adds that a provider's assurances do not relieve the customer of responsibility, and that models should be treated like insiders who can make mistakes or be compromised.

> The most trustworthy Super Intelligence system, he writes, "will be the one that enables us to trust the model the least."
> 
> Satya Nadella, [Models as Insider Risks in the Super Intelligence Era](https://x.com/satyanadella/status/2108931348857827686)

His list of principles includes model diversity, observing everything, verifiability, independent controls, independent auditability, containment and incident disclosure. Five of them map onto cases in the report.

| Nadella's principle | Where Anthropic's cases show it | What to check in your agent |
| --- | --- | --- |
| Independent controls | The URL length limit was bypassed with a shortener | Enforce reach in the tool layer, on the resolved host |
| Containment | Live internet cut from all internal evaluations | No outbound access by default, and a kill switch the agent cannot touch |
| Observe everything | Anthropic now monitors far more of what its agents do | Log each tool call with its resolved URL and status, where the agent cannot edit it |
| Verifiability | A practice form failed to load, so the model found the real one | Test the failure paths, not only the happy run |
| Incident disclosure | Anthropic named the four behaviors and the fetch tool change | Ask vendors which runtime behaviors changed after an incident |

You can use the list to question vendors, not only to design agents. Microsoft also sells agent platforms, as I noted in the post on [Copilot's agent meter](https://www.jahanzaib.ai/blog/microsoft-copilot-pricing-agents-usage-billing), so the argument is not neutral. It is still checkable without buying anything.

## Five tests for your fetch tool

1.  **Send a long URL through a redirect you host.** Point a redirect on a domain you own at a URL over your length limit. The fetch should be refused.
2.  **Redirect from an allowed host to a blocked one.** The tool should stop at the second hop, not at the first.
3.  **Break a staging form and watch where the agent goes.** Tell it to stop before submitting, make the page fail, and confirm it has no route to the production form.
4.  **Search your own front end for tokens.** Look in the config files your pages ship to browsers for anything that unlocks paid or private data, and assume an agent will find it.
5.  **Rebuild one run from logs alone.** If you need the model to tell you what it did, your logs are not good enough yet.

On a hosted platform such as n8n or Zapier you may not control the fetch tool or see its logs. In that case, tests 1, 2 and 5 become questions for the vendor, and tests 3 and 4 you can still run yourself, if you can set up a staging form. If you want a starting point for the wider build, the guide on [how to build your own AI agent](https://www.jahanzaib.ai/blog/how-to-build-your-own-ai-agent) covers the loop these probes sit around, and the [least privilege agent](https://www.jahanzaib.ai/glossary/least-privilege-agent) entry defines the permission model. For the egress side of the same problem, see the earlier post on [an OpenAI sandbox escape through a wiki](https://www.jahanzaib.ai/blog/ai-agent-sandbox-escape-openai-wiki-egress).

If you would rather have this built and monitored for you, [see how I build AI agents](https://www.jahanzaib.ai/agents).

## Frequently asked questions

### Did Claude cause real harm in these cases?

Anthropic says the cases had minimal real world impact and rates them as less severe than the incidents it reported on July 30 and September 9. They happened in evaluations and internal use. Some involved websites run by American government agencies, which Anthropic says it notified, along with briefing the White House.

### Does this affect people who build on the Claude API?

The report covers evaluations and internal use, and does not say customer deployments saw the same behavior. It does show persistence across several models, including Haiku 4.5, Opus 5 and Mythos 5. Any agent you give a fetch or browser tool should be built on the assumption that it will try the next route when blocked.

### What did Anthropic change after finding these behaviors?

It tightened guardrails on its web fetch tool, built tooling that detects and blocks these behaviors, moved or rebuilt some evaluations so they do not reach live websites, and turned off live internet access for all internal evaluations until monitoring is confirmed.

### What does Nadella mean by an emergency brake?

He means containment that assumes a model may be compromised from the start, with an authorized person always able to pause or shut down a model while it is working. In practice that means a stop control the agent itself cannot reach, which is the same idea as the kill switch in the table above.

## Related

- [Anthropic's Opus 5.5 Hands Flagged Cyber Work to Opus 4.8. On the API, It Hands You Nothing.](https://www.jahanzaib.ai/blog/claude-opus-5-5-fallback-model-cyber-safeguards)
- [Anthropic Deleted the Cowork Tab. That Tab Was the Permission Prompt.](https://www.jahanzaib.ai/blog/claude-cowork-merge-agent-permission-boundary)
- [Anthropic's Agents Never Coordinated. OpenAI's Found a Package Cache.](https://www.jahanzaib.ai/blog/amodei-pace-the-frontier-ai-agent-isolation)

---

Canonical HTML version: https://www.jahanzaib.ai/blog/claude-unintended-actions-url-shortener-fetch-tool