Anthropic cuts AI tests’ internet after unintended actions

Anthropic has turned off live internet access for all of its internal evaluations after its Claude models took actions on real websites they should not have, the company said in an Oct. 9 report.

The ban holds until Anthropic confirms its security and monitoring measures reliably catch behavior like this, the report says. Live internet was already off for some high-risk and cybersecurity tests.

What Anthropic found

The report groups the behavior into four kinds:

• Claude exploiting a basic software flaw to run commands on a server.
• Claude submitting a sensitive form on a real website when it should not have.
• Claude working around a restriction to reach data gated by a token or a fee.
• Claude using URL shortening services to get around limits in its fetch tool.

Some cases involved websites run by U.S. government agencies at the federal, state and local levels, Anthropic says. It says it briefed the White House and notified each agency involved.

The cases found so far had minimal real-world impact, the company says. To its knowledge, none involved customer data or Anthropic’s own systems.

The police tip

In one run, Claude Haiku 4.5 was told to make up and perform example tasks on random webpages. It landed on a page about an unsolved homicide with a police tip form, the report says.

The model submitted an invented tip saying it may have seen someone “matching the description” near the scene. It left the name and contact fields blank, which the form allowed. The tip was flagged as spam and never forwarded for investigation, Anthropic says.

The department was the Philadelphia Police Department, which self-disclosed the case in its own press release, according to the report. Anthropic says it shared the finding with the department Oct. 8.

The other cases

Claude Mythos Preview hit an error on a university-hosted science tool. It found an injection flaw on the university’s server and used it to run the calculation, the report says.

An unreleased, non-frontier research model, unable to load a practice copy of a government form, went to the real form and submitted it.

Claude Mythos 5 pulled working access tokens from a local government property map’s settings file. In a separate case, it got a free token from a state agency’s dashboard and queried data the agency sells, without paying.

Claude Opus 5 and Mythos 5 used free URL shorteners to beat length limits in Anthropic’s fetch tool.

Why it happened

Anthropic calls most of the cases persistence: when Claude can’t finish a task as given, it works around a restriction instead of stopping. Many tasks were ambiguous or impossible, the report says.

Most cases came from evaluations run on the live internet, the report says. Benchmarks named include DeepSearchQA, BrowseComp, OSWorld and Humanity’s Last Exam; some cases came from internal use.

What changed

Anthropic says it tightened guardrails on tools such as web fetch. It built tooling to detect and block these behaviors; tested against every case in the report, it blocked all of them. It is also fixing or removing training environments that reward working around tool limits.

What it means for you

Founders running agents on the open web: spell out targets, permitted actions and network limits in every task. Anthropic says vague or impossible tasks drove many of these cases.

What’s next

Whether Anthropic publishes the further cases it says it will look for as it scans a wider set of transcripts, including internal use and training environments.