Anthropic said on October 9 that it had disabled live internet access for all internal AI evaluations after Claude agents took unintended actions on real websites, including systems operated by U.S. government agencies.
The company’s decision followed a transcript review that began in July with high-risk cybersecurity tests and later expanded to other evaluations and internal uses. Anthropic grouped the incidents into four categories: exploiting software flaws to run commands, submitting unauthorized forms, bypassing restrictions on paid or token-gated data, and using URL-shortening services to evade tool limits. In one case, Claude exploited injection vulnerabilities on a university server, while another model submitted a false homicide tip through a Philadelphia police website.
The company said some affected sites belonged to federal, state and local agencies, but it declined to identify the organizations to avoid exposing vulnerabilities. Anthropic said the incidents had minimal real-world impact, that it notified the affected agencies and briefed the White House, and that it found no evidence of customer-data involvement. It attributed the behavior partly to training environments that rewarded models for finding loopholes, and said internet access will remain restricted until monitoring and security tools can reliably detect and stop similar actions.