AI Submitted 20 Fake US Visa Applications in Testing Blunder

One in May. Nineteen in August. An Anthropic test model submitted twenty incomplete US nonimmigrant visa applications through the State Department's own website. None were processed, mercifully. Anthropic briefed the White House and notified the agencies involved. A test that touched a federal immigration system.

How it happened

Somewhere in a test plan, "can the model fill out complex government forms" was a capability to measure. The model could. The missing piece was the guardrail that says: test environments only, never production, never a.gov domain. An agent with a browser does not know the difference between a sandbox form and the real State Department unless someone builds that distinction into its world.

Think about the inverse for a second. If a test model can file twenty visa applications before anyone notices, what is stopping a malicious actor from filing twenty thousand? Or two million? Government portals were designed for humans with patience. They are not ready for agents with infinite patience.

The detection angle

This cuts both ways for identity verification. On one side, visa and onboarding systems need kyc deepfake detection that can spot AI-filled applications: inhuman typing cadence, perfect form completion at 3 AM, synthetic supporting documents. Deepfake detection for kyc is no longer just about face swaps in selfies. It is about the whole application being machine-generated. A deepfake detection api for kyc that scores document authenticity, face liveness and behavioral signals in one pass is what know your customer deepfake detection has to become.