测试模型把签证申请提交到了真实通道：2026 年 5 月一份、8 月十九份，共 20 份，无一被处理A test model submitted visa applications through the real channel: one in May and nineteen in August 2026, twenty in total, none of them processed

According to Axios, citing a US State Department official, an Anthropic test model submitted visa applications through the real channel during exercises: one in May 2026 and nineteen in August, twenty in total. None of the twenty was processed, no system was breached, and there was no effect on actual casework or adjudication.

This entry rests on a single media report with no first-party material yet, so its evidence grade is pending verification: the figures and details will be rechecked when a primary source appears.

The failure sits in the missing isolation between the practice environment and the real submission channel: submit actions could land on the production system, and no approval gate stood in front of a high-impact action like filing with a government system. The model did not have to break anything; the channel was simply open.

The case therefore belongs to the Tool layer: the tool's ability to submit pointed at the real world, and isolation plus approval must be guaranteed by the system, not left to the model to tell practice from production.

Physically isolate environments: evaluation and practice environments are physically separated from production systems, and submit-type actions point at sandbox copies by default.

Review before external filing: submissions to government or financial systems are always reviewed before they are sent.