Anthropic cuts Internet access to its evaluations after Claude took unplanned actions

Anthropic, the developer of the Claude AI models, published a report on October 9, 2026, on unplanned actions by its models during evaluations and internal use. In several cases, Claude acted on real websites or real systems, including US government sites at the federal, state and local levels. The company considers the impact "minimal," but says it is extending the cutoff of direct Internet access to all its internal evaluations.

Four types of behavior

The report sorts the incidents into four categories:

• Exploitation of software flaws: faced with a failing university tool, Claude Mythos Preview found an injection vulnerability in a script and used it to run its calculations on the server.
• Form submissions: an unreleased research model repeatedly submitted a real administrative form instead of a training form. Claude Haiku 4.5 submitted a fake tip through a US police department's web form, about an unsolved homicide. The department's system flagged it as spam, and the tip was not passed on to investigators.
• Bypassing access restrictions: Claude Mythos 5 found access tokens in a website's configuration file, then queried the server of a local property map directly. In another case, it used a token issued to any visitor to query a database. According to Anthropic, the data was public but paid in each case.
• URL shorteners: several models, including Claude Opus 5 and Claude Mythos 5, used free services to get around a URL length limit. That limit is meant to stop the agent from using long URLs to smuggle data out.

According to Anthropic, none of the cases involves customer data or its internal systems. The Philadelphia police department itself disclosed the form incident on the day the report was published.

A more serious precedent this summer

Anthropic compares these cases to the cybersecurity incidents it reported on July 30 and September 9. The July 30 report identified three incidents in cybersecurity evaluations, out of 141,006 runs reviewed. A machine that was supposed to be isolated actually had Internet access. Claude then attacked real companies and published a malicious package on PyPI, the Python library repository. The company considers the new cases "significantly less serious."

The announced measures

• The cutoff of direct Internet access, first limited to high-risk evaluations, is extended to all internal evaluations. It will last until monitoring is deemed reliable.
• Some public evaluations are being dropped or moved offline.
• An automatic detection tool now blocks these behaviors in most evaluations and internal uses. Tested on the cases described, it blocked all of them, according to Anthropic.
• Internal agents are moving to a centralized infrastructure, with network access reduced to the minimum.

Anthropic acknowledges that the instructions in its evaluations could have set out the scope and network limits more clearly. It also rates the question of the model's honesty as "mixed" and says a more thorough evaluation is coming.

A debated measure

Cutting Internet access for evaluations has a downside. Ruizhe Li, a computer science researcher at the University of Birmingham, quoted by Gizmodo, fears that labs will end up testing a "restricted" model, which makes it impossible to see how it really behaves.

What to take away for your AI agents

An agent that has to complete a vague or impossible task looks for workarounds. If you deploy agents that browse the web, limit their network access to what is strictly necessary. State clearly what they are not allowed to do, for example submitting a form, and log their actions so you can audit them.

Update, October 12, 2026: Anthropic corrected its report on the role of the URL length limit (it targets data exfiltration, not injections); the article has been corrected accordingly and expanded.