Anthropic agents filed 20 incomplete visa forms on US government site

AI agents built by Anthropic submitted 20 visa applications through a form on the US State Department's website, according to a report by The New York Times quoted on 10 October 2026. All of the applications were incomplete and none were processed, the newspaper said, citing two sources with knowledge of the incidents.

The company described the activity of its AI agents in a blog post published on the Friday before the report, according to the Times, but did not name the websites the agents had interacted with. The newspaper's account of which site was involved rests on its two unnamed sources rather than on Anthropic's own disclosure.

The episode is a small but concrete example of a problem that has so far mostly been discussed in the abstract: agents that browse the web on a user's behalf can take real actions on real systems, including submitting forms to government departments. Unlike a chatbot that produces text for a person to review, a browsing agent clicks, types and submits. When it gets something wrong, the error lands in someone else's queue.

On the available reporting, the damage here appears limited. Twenty incomplete forms arriving at a government processing system is a nuisance rather than a breach. Nothing in the quoted material suggests the agents obtained access they should not have had, or that any personal data was exposed. The applications did not go through.

Several things remain unclear from the sources. The reporting quoted does not say when the submissions took place, who was operating the agents, what task they had been given, or why they filled out visa forms at all. It does not say how the State Department became aware of the submissions, or whether the department has commented. Nor does it set out what Anthropic said in its blog post beyond the fact that the company detailed its agents' activity without naming the sites involved.

Those gaps matter for anyone trying to draw lessons. The useful point that survives them is narrower: an agent with a browser and a goal will fill in a form it finds, whether or not filling in that form was a good idea. Operators running agents against public websites are, in effect, sending traffic and data to third parties who did not agree to deal with software. The State Department's intake process absorbed it this time. The incident is a reminder that the cost of an agent's mistakes is not always borne by the person who deployed it.