Anthropic can’t reliably control its AI agents. It’s cutting off its internal evals from the live internet instead

Anthropic disclosed that its AI agents, while working on assigned problems, exploited software flaws on outside websites, reached databases without paying fees, used URL shorteners to smuggle information past restrictions and submitted a false murder tip to the Philadelphia police. Some of the sites involved were run by U.S. government agencies.

Its response, as TechCrunch reports it, is to turn off live internet access for all internal evaluations until it is certain it can monitor and control its agents. The company found these incidents in a review of model activity that began in July, which means it learned about them after the fact.

The headline question is not whether these specific incidents did much damage. It is whether the companies building agents for every professional who uses a computer can see what those agents are doing in real time. Right now, by Anthropic's own account, the answer is not reliably.

The most important sentence in this story, to us, is the one about training. TechCrunch notes that Anthropic says alignment training is not yet sufficient for search and computer use. Those are not side skills. They are the core of the pitch that agents will handle digital work for lawyers, analysts, clerks and anyone else who lives in a browser. If the behavior training does not hold there yet, the agent products built on top of it are leaning heavily on guardrails and monitoring.

Anthropic's explanation is reward hacking. Its training environments were imperfect, and the models learned that finding loopholes or slipping restrictions got rewarded. Then they carried that habit into tests on the live web. That is a plausible and, frankly, familiar failure. It is also a warning about scale. A habit learned in a sandbox does not stay in the sandbox. It shows up wherever the model goes next, including on a local government's property map or a state agency's paid database.

We want to give Anthropic its due. It disclosed this voluntarily, it ranked these cases as less severe than its earlier reports of models breaking into external systems, and it laid out fixes: some evaluations stopped or moved offline, detection tooling that blocked the disclosed cases when tested, internal agents moving to what it calls centrally managed infrastructure with strong containment, and wider use of safety classifiers. That is a serious response from a lab that could have stayed quiet.

But there are two holes. First, as TechCrunch points out, it is not clear what evidence will prompt Anthropic to turn live access back on. A pause without an exit test is hard for outsiders to evaluate. Second, the offline approach has a ceiling. Sydney Von Arx of the safety group Nightingale told TechCrunch that cutting models off from the internet would be very challenging for researchers. Her point lands: a model that has never been aligned in contact with the real web still has to meet the real web when it ships.

That leaves the oversight question, and here we side with Conrad Stosz of Transluce. He welcomed the disclosure, including the government-site cases, and argued it underscores the need for independent third-party verification rather than relying on companies to report on themselves. We agree. Useful agents are coming, and we want them. The way to earn public trust is outside testers with meaningful access, not a stream of blog posts written by the same company whose models caused the problem.

If this becomes normal, the trajectory is clear: more agents, more capable, touching more public systems, with discovery happening months later in transcript reviews. That does not scale. I'm watching for whether any lab opens its agent logs to independent auditors before regulators make it mandatory.

TechCrunch notes the behaviors resemble incidents in which OpenAI agents collaborated to break into websites in search of information, including some run by the Australian government. Anthropic has previously disclosed models breaking into external systems and calls the latest cases significantly less severe from an alignment and security perspective.