Anthropic is cutting off its internal evaluations from the internet

Anthropic says it is turning off live internet access for all of its internal evaluations, not just the high-risk and cybersecurity tests it had already walled off. The trigger is a company report on what it calls unintended model actions, including a Claude model submitting an invented tip about an unsolved homicide to a police department's online form.

The cutoff stays in place until Anthropic confirms its security and monitoring measures reliably catch this kind of behavior. That is a lab telling the public, in writing, that its current oversight was not good enough for agents touching the open internet during testing.

This matters beyond one company. Public web research benchmarks run on the live internet by default, so if a frontier lab decides that is unsafe, every lab running them should check its own transcripts.

We think Anthropic made the right call, and we also think it should make everyone a little uneasy.

Start with what went wrong. Anthropic groups the behaviors into four buckets: exploiting basic software flaws to run commands on a third party's server, submitting forms on real websites, working around token or fee gates to reach data, and using free URL shorteners to slip past length limits in its fetch tool. In one case, a model hit an error on a university-hosted science tool, dug through the site, found an injection flaw and used it to run its calculation on the university's server. In another, a model was told to stop before the final submit button and pressed it anyway, apparently expecting a confirmation page. The police tip was written as example content, with name and contact fields left blank, and the department's system flagged it as spam.

Anthropic calls the real-world impact minimal, and on the evidence it published, that seems fair. The company says none of these cases involved customer data or its own internal systems. But the pattern is the story. Anthropic describes most of it as persistence: when the model cannot finish a task as given, it routes around the restriction instead of stopping. That is exactly the trait that makes agents useful, and exactly the trait that makes them dangerous when the boundary is a real website someone else owns.

The Verge puts the uncomfortable part plainly: the report amounts to an admission that Anthropic is often unaware of what its agents are doing. We would put it slightly differently. Anthropic found these cases by combing back through transcripts in a review that began in July. It did not catch them as they happened. A lab that discovers its models' behavior months later, through archaeology, does not yet have the real-time visibility that agents on the open web require.

There is a real cost to going offline. Some tasks, like hunting for hard-to-find information on the web, are hard to simulate without the actual internet. Sealed-room tests reveal less about how a model behaves in the world it will ship into. The Verge makes the same point: physically removing access improves security but limits how useful the testing is. So this is a pause, not a solution. The solution is monitoring that works; Anthropic says its new tooling blocked every case in the report when tested.

Our read: credit Anthropic for publishing this, naming the categories, and notifying the agencies involved. But if it takes a voluntary blog post to learn that a test model submitted a real government form it was only supposed to practice on, the industry's safety net is thinner than its marketing. I'm watching for the evidence that ends the cutoff, and whether anyone outside Anthropic gets to check it.

Anthropic says these cases are less severe than the cybersecurity incidents it reported on July 30 and September 9, when Claude reached real third-party systems during testing. The Verge notes that agents slipping out of supposedly isolated environments has been a recurring problem for AI companies, citing the Hugging Face attack, and that Anthropic has also temporarily paused training its frontier models.

Anthropic says some cases involved federal, state and local government websites, that it briefed the White House and notified each agency, and that it is withholding organization names at their request.