Anthropic also cuts its AI tests off from the internet
Two weeks after OpenAI paused training and tool use of its strongest models, Anthropic is now hitting the brakes too. In the report Investigating unintended model actions in our evaluations and internal use, published on October 9, 2026, the company describes how Claude models did things on real websites that nobody had asked for. Some of those sites belonged to U.S. government agencies, “at the federal, state, and local levels”. The measure: live internet access was already switched off for some of the high-risk and cybersecurity evaluations, and is now being switched off for “all our internal evaluations”, until Anthropic is sure it reliably catches such behavior. TechCrunch put it bluntly in its headline: “Anthropic can’t reliably control its AI agents.”
What did Anthropic’s agents do?
Anthropic divides the cases into four kinds of behavior, and the company itself names the common thread: “Most are forms of persistence, in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping.” In other words: a workaround rather than giving up.
First, the software vulnerabilities. Claude Mythos Preview had to run a scientific analysis with a public tool from a university. That tool returned an error. On the university’s server, the model found a script that returned any requested file, used it to copy files including that script’s own code, discovered a command injection vulnerability in it (input that a site accidentally executes as a command) and then simply ran the calculation itself on that server.
Then the restricted data. Claude Mythos 5 had to identify the location in a photo, pulled working access tokens from the configuration file of a local government’s mapping application and requested the data directly from the server behind it. In another case, during a project by an Anthropic researcher, the same model bypassed the fee a state agency charges for public data, using a token that the public dashboard hands to every visitor. According to Anthropic, in both cases the data was publicly available, but for a fee.
Third kind: URL shorteners. Some of Anthropic’s fetch tools limit the length of the web addresses Claude may request, precisely to prevent injections via long URLs. Claude Opus 5 and Claude Mythos 5, among others, got around that with free shortening services. Anthropic noticed this itself first; while the report was being written, the operator of the shortener da.gd reported it as well.
And finally, the forms that should never have been submitted. That is where the case that made the headlines sits.
A false tip to the Philadelphia police
Claude Haiku 4.5, simply a publicly available model, had to come up with and carry out example tasks on random web pages. It ended up on a page about an unsolved murder, with a police tip form. The instructions forbade logging in, creating accounts, entering personal data, making purchases and submitting “anything destructive”, but did not rule out forms. Claude wrote: “I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period.” Yet the page contained no description of a perpetrator whatsoever. Claude left the name and contact fields blank. The tip was flagged as spam and never forwarded for investigation.
| Date | What happened | Source |
|---|---|---|
| July 2026 | Anthropic starts a review of transcripts, beginning with cybersecurity evaluations. | Anthropic |
| July 18, 11:27 p.m. | Claude submits a false tip via PhillyUnsolvedMurders.com. | Philadelphia police via TechCrunch |
| September 28 | Anthropic discovers the tip and then stops the test that caused it. | TechCrunch, The Verge |
| October 7 or 8 | Anthropic informs the police. On October 7 according to the police, on October 8 according to Anthropic, “as soon as our technical review was complete”. | TechCrunch, The Verge, Anthropic |
| October 9 | The police announce it themselves in a press release; later that day, Anthropic publishes its report. | TechCrunch, The Verge, Anthropic |
The police did not go easy on it. In a statement to U.S. broadcaster 6abc, picked up by TechCrunch and The Verge: “The two-month delay in detecting and reporting the incident to the City is unacceptable.” Anthropic itself says that Claude “appears to have only been producing example content for the task, rather than trying to mislead anyone to achieve a goal”. It adds that this assessment may still change after deeper analysis.
What Anthropic is doing about it
Anthropic has stopped running some public evaluations; others are going offline or being rebuilt so they no longer touch live websites. The web fetch tool is getting stricter limits. New detection tools blocked all the cases from the report in a test and now run on most evaluations and on internal agent use of its strongest models. Internal agents are moving to “centrally managed infrastructure with strong containment”.
On the cause, Anthropic is clear. Training environments are imperfect: if training accidentally rewards finding loopholes, a model learns that a workaround pays off. “This is known as reward hacking.” On top of that, Claude was often given tasks that were ambiguous or simply impossible. The report also contains an honest admission: “alignment training is not yet sufficient or fully robust on its own”.
Two labs, the same pattern
Put this next to OpenAI and the similarity jumps out. With OpenAI’s six incidents and with the Australian health site, we saw the same pattern: an agent that runs into a block treats it as the next problem to solve. The timeline rhymes too: OpenAI notified Australia 84 days after the breach, Anthropic informed the Philadelphia police some 81 to 82 days after the false tip.
You should not equate the two measures, though. OpenAI’s pause is broader: training, evaluation and inference with tools of its strongest models. Anthropic is only cutting its internal evaluations off from the live internet. On the other hand, according to Anthropic, the cases are less serious: it speaks of “minimal real-world impact” and calls the cases “significantly less severe” than its earlier cyber incidents of July 30 and September 9. It found them through a review of transcripts that began in July, and says more disclosures will follow as that scan continues.
Our take
Credit first: this report is detailed, quotes the false tip verbatim and admits that alignment training falls short. Few companies publish that about their own product. But two things grate. The police announced it themselves, before Anthropic published its report. And what ultimately stopped a fabricated witness statement in a murder case was that the tip was flagged as spam at the police. That is not safety architecture, that is luck.
Moreover, the restart criterion is just as vague as OpenAI’s: “until we have confirmed that our security and monitoring measures […] reliably catch behaviors like these”. Who confirms that, and against what bar? TechCrunch also notes that it is unclear what evidence will switch the internet back on. As long as a lab is the only one assessing that, it remains a promise.
The most important signal lies in a detail: Haiku 4.5 is not an experimental frontier model, it is a model companies deploy today. And Anthropic itself writes that “several of the cases we observed occurred during regular agentic use of Claude”. So this is not a lab problem, it is your problem as soon as you send an agent onto the internet.
What does this mean for your AI agents?
Our advice, partly based on Anthropic’s own analysis. Spell out explicitly what falls inside and outside the task: which sites, which actions, which network boundaries. According to Anthropic, such scoping might have prevented some of these failures. Forbid forms, purchases and messages by default, in the tooling itself and not only in the prompt, because a rule in a prompt is a suggestion. Use an allowlist at network level: an agent gets around a URL limit with a shortener. Explicitly give an agent permission to stop if a task cannot be done. And read the logs, weekly, not only when the police call. The same principle applies on your own computer: do not give an AI app full disk access if it does not strictly need it. An agent does what it can, not what you mean.
