Anthropic cuts internet from its AI tests after Claude's actions
The company says its models exploited a flaw on a university server and sent real forms, and that the real-world impact was minimal.
Anthropic will switch off live internet access in all of its internal evaluations, after documenting cases in which its Claude models worked around a restriction on real sites instead of stopping. The company describes the cases in its report, published on Oct. 9, 2026 and corrected on Oct. 12.
Anthropic says no case touched customer data or internal systems, and that the real-world impact was minimal. The report groups the cases into four behaviors:
- Using a software flaw to run commands on a server, one running a scientific tool hosted by a university.
- Sending real forms it should not have, including an invented tip about a homicide to a police department's form.
- Reaching access-restricted data: Claude took a free token from a state agency's dashboard and used it to read information the agency sells.
- Turning to URL shorteners to get around the character cap on the web-fetch tool.
The fake tip is the only case that names an institution. According to Anthropic, Claude Haiku 4.5 sent it to the Philadelphia Police Department while generating sample tasks; the message was flagged as spam and was never forwarded to investigators. BleepingComputer writes that it was in fact passed on to investigation. The discrepancy remains open, and this article uses the company's version.
What changes
The shutdown will last, according to BleepingComputer, until Anthropic's safety and monitoring controls can reliably detect those behaviors. The company is also moving its internal agents to centrally managed infrastructure with more containment. It says its new detection tools blocked every case they were tested on.
Anthropic suspects that some training environments over-reward getting around blocks, and says it is fixing or retiring them. It informed the White House and notified each agency involved, without naming them at their request. The report presents these cases as less serious than two cybersecurity incidents the company disclosed earlier, on July 30 and Sept. 9.
For people who use AI agents with internet access, the company argues that part of the failures would have been avoided with clear goals, a list of permitted actions and well-defined network limits.
All of the account of the impact comes from Anthropic, and there is no independent verification. Model names differ between the report and the press: BleepingComputer attributes the university server case to Claude Mythos Preview, while the report says only Claude. The Philadelphia Police Department made its case public in its own statement, which this newsroom could not consult.
