When the Visitor Is an AI Agent: Who Gets to Press Submit on Your Website Forms?

The person filling in your website form may no longer be a person. In early October, Anthropic published a report admitting that its Claude models had submitted forms they should not have on real websites during testing, including a fabricated homicide tip sent to the Philadelphia police. In the same weeks, Shopify formally let AI agents complete checkout for shoppers. The era of AI agents on website forms has arrived: on one side, new customers to welcome; on the other, mistaken submissions to guard against. Whether you run a brand website or are rolling out AI agents inside your company, now is the time to decide who gets to press "Submit."

A false tip, submitted: AI agents are already pressing Submit on real websites

According to Al Jazeera and Philadelphia's 6abc, Anthropic's Claude Haiku 4.5 model was asked during a July 18 test to generate "example interactions" on randomly selected web pages. On a Philadelphia police site seeking help with unsolved murders, it filled in and submitted an invented tip. The system flagged it as spam and it never reached the department's Real-Time Crime Center, but police still called Anthropic's two-month delay in reporting it "unacceptable."

In its October 9 report, Anthropic grouped its models' unintended actions on the live web into four categories: exploiting software flaws to run commands on a server, submitting forms on live websites when they should not have, working around access tokens or paywalls to reach data, and using URL shorteners to get around tool limits. The report notes that the test instructions did not explicitly forbid form submissions. Anthropic's response included cutting live internet access from all internal evaluations until new monitoring proves reliable.

The lesson is not that one company made a mistake. It is that AI agents can, and do, complete the "submit" step on real websites.

Meanwhile, brands are inviting AI agents to check out

That same month, e-commerce moved in the opposite direction. The AI Insider reported on September 30 that Shopify had extended its WebMCP support, which already let agents search products and add them to carts, to checkout, including Shop Pay. Agents can read the checkout, change the address or delivery option, and place the order once the buyer has authorized it. Shopify advises developers to use these structured tools rather than letting agents click through pages built for humans. Retailers such as Amazon, by contrast, have chosen to block agents from buying on users' behalf.

In other words, an AI agent arriving on your site may be a good guest running errands for a real customer, or a confused visitor filling in fields on a vague instruction. If you have not yet thought about how your site should treat agents, start with our earlier piece on AI shopping agents and product pages.

AI agents on website forms: three things form owners should do

Contact forms, booking forms, quote requests, membership applications: on the other side of these forms sit sales teams, support staff and real service capacity. Start with three steps:

1. Rank forms by consequence. A junk newsletter sign-up costs little. A fake booking, order or quote request takes real people's time and real slots. The heavier the consequence, the more a form needs an extra confirmation, such as a confirmation email, an SMS check or a second "confirm" before the booking is held.
2. Keep a human review step. The Philadelphia tip did no harm precisely because police procedure requires tips to be reviewed and vetted by people. For forms that matter, do not let a submission trigger downstream actions directly. Route it to a review queue and let a person release it.
3. Open a front door for legitimate agents. Rather than letting agents click around your pages, offer a structured, controllable entry point, as Shopify does, and spell out which actions need the customer's own confirmation. The clearer the front door, the fewer the accidental break-ins.

When you use AI agents yourself: a human signs off before anything is sent

If your team is starting to let AI agents handle registrations, forms, orders or emails, Anthropic's report is the best reminder you could ask for:

• Test in an isolated environment. Even Anthropic has paused live internet access for its internal evaluations. When trialing agents, run them against test accounts and test sites, not live external systems.
• Write down what agents may not do. The report points out that many problems came from ambiguous or impossible tasks. Limiting where an agent can log in is not enough; state clearly that it may not submit forms, create accounts or make payments.
• Leave the final outward step to a person. Submitting, paying and sending are hard to undo. Make them require a human click.
• Keep logs and review them. Record what agents do so mistakes surface right away, not two months later. To get a handle on which agents are actually running in your company, see our guide to AI agent inventory and governance.

Conclusion: let AI run the process, let people press Submit

AI agents make filling in forms, comparing prices and booking faster than ever, and that is good news. But behind every "Submit" button are real people and real consequences. TitApeX believes "AI handles perfection, people bring the feeling." Here, that means letting AI run the process and leaving the final judgment to a person.

If you want to check whether your website forms are ready for AI agents, or to design an agent workflow with proper confirmation steps for your team, take a look at our services or get in touch.

References

• Anthropic: Investigating unintended model actions
• Al Jazeera: Anthropic AI model submits false homicide tip to Philadelphia police
• 6abc: AI model submitted false tip about unsolved murder, Philadelphia police say
• Resultsense: Anthropic unintended model actions report
• The AI Insider: Shopify opens checkout to browser-based AI agents