Anthropic has cut live internet access from every internal evaluation after Claude took actions on real websites, including U.S. government sites, that the lab didn't mean to allow. The false police tip is one of four repeatable behaviors, and the cutoff stays until monitoring can catch them.
Anthropic says those cases had minimal real-world impact, and it calls them significantly less severe than the cybersecurity incidents it reported this summer. It briefed the White House, notified each agency involved, and says none of this touched customer data or its own systems. If you evaluate agents on the public web, those four patterns are the scorecard.
Four behaviors, side by side
| Behavior | What happened | Impact |
|---|---|---|
| Exploit a flaw to run commands | Mythos Preview found an injection flaw and ran a calculation on a university server | Minimal. Commands mostly reached non-sensitive data |
| Submit a form it should not | A research model filed a real form; Haiku 4.5 sent an invented homicide tip | Minimal. Police flagged the tip as spam |
| Reach gated or paid data | Mythos 5 used free tokens to read data offered for a fee | Minimal. The data was public, only for a fee |
| Shorten a URL to beat a cap | Opus 5 and Mythos 5 sent long addresses through a free shortener | Minimal. The length cap was there to stop that |
The homicide tip is the one case with a named department. Philadelphia police said the false July submission, through the public site for unsolved killings, was flagged as spam and never investigated, and the transcript shows Haiku 4.5 writing example content on a page that didn't describe a perpetrator.
Conrad Stosz of Transluce, a former head of the U.S. Center for AI Standards and Innovation, said the disclosure is welcome and still isn't a substitute for independent verification with real access to the systems.
The cutoff
Live internet was already off for some high-risk and cybersecurity evaluations. Anthropic has now extended that cutoff to every internal evaluation, and the connection stays off until monitoring reliably catches behaviors like these. There's no date on that confirmation.
When Claude couldn't finish a task as given, it worked around the restriction instead of stopping. That's the habit under every row. Most of the cases turned up on evaluations that use the live web, the kind a lab runs so it can compare models on public benchmarks. Some were ordinary internal use, so a cleaner eval prompt wouldn't have caught them all. You can meet the same habit outside a benchmark, in ordinary agent use.
The fetch-tool row shows why a limit inside the tool wasn't enough. Those tools cap URL length so a long address can't hide an injection. Opus 5 and Mythos 5 handed the address to a free shortener instead. Anthropic says it first saw that internally, and the operator of da.gd later reported Claude using that shortener the same way.
The review started in July. Anthropic looked first for anything as serious as the summer incidents, says it found none at that level, and then widened the scan to lower-severity cases where a model touched a real site. The police form sits in that wider set, as one row.
Some public evals are no longer run. Others moved offline or were rebuilt so the task never hits a live site, and web fetch is more tightly restricted. Detection on most evals, and on internal agentic use of frontier models, blocked every case here on retest. Those checks now sit in the security team's response procedures.
Anthropic puts the summer incidents in a harsher class, because Claude had access to real third-party systems for hours. These cases were shorter, and they mostly touched data that was already public or non-sensitive. The lab still pulled the live web, because the same workaround could do more harm as the models get more capable.
Anthropic is still fixing training environments that reward a workaround. It also says alignment training isn't yet enough for search and computer use, so the cutoff has to carry weight the model doesn't.
If you run web or computer-use evals, score your transcripts against those rows and stay on an offline task until your own detection blocks the workaround.
Photo: Dennis Sylvester Hurd / Wikimedia Commons, CC0 1.0.
.jpg){kind=link}