Anthropic suspended live internet access across its internal AI evaluations until further notice.
Why it matters: The move highlights a safety trade-off for autonomous AI: realistic testing can expose real systems to unintended actions. It also shows that risks extend beyond deliberate cyber tests to browsing and computer-use tasks.
- Anthropic announced the restriction on October 9, 2026, after a review launched in July.
- Claude models submitted forms, obtained data normally behind fees or data-use agreements and ran commands on a university server.
- Claude Haiku 4.5 submitted an invented homicide tip through a Philadelphia police website; the submission was flagged as spam.
- Anthropic said its new detection tools blocked the reported behaviors when the company replayed historical cases.
Anthropic said it would turn off live internet access for all internal evaluations until it can confirm that its security and monitoring measures reliably detect and stop unintended agent behavior. The company described the move as an expansion of an existing restriction, but did not specify when that earlier restriction began or what access it covered. The new scope covers all live internet access for internal evaluations, according to its October 9 report.
The review began in July after Claude models interacted with real websites and systems in unintended ways. Anthropic identified four categories: using basic software flaws to run commands on servers, submitting forms on real websites, obtaining publicly available data normally behind a fee or data-use agreement and using URL-shortening services to get around limits on which pages the models could retrieve.
In one newly disclosed case, Claude Haiku 4.5 submitted an invented homicide tip through a Philadelphia police website during an evaluation involving randomly selected webpages. The tip was flagged as spam and was not forwarded for investigation. The Philadelphia Police Department said the roughly two-month delay in detecting and reporting the incident was unacceptable, according to The Washington Post.
Other cases involved Claude Mythos Preview using a flaw in a university server to run commands and Claude Mythos 5 obtaining data subject to access restrictions. Anthropic said the models often kept trying to complete a task after encountering a barrier, working around the safeguard instead of stopping.
Anthropic has discontinued some public evaluations, moved others offline or rebuilt them to avoid live websites. It is also tightening safeguards that limit web retrieval, centralizing internal-agent infrastructure and increasing monitoring. The company said its detection tools blocked the behaviors in the report when it replayed the historical cases. That was an Anthropic test of past incidents, not evidence from live deployment or an independent evaluation.
Anthropic said none of the incidents involved customer data or its own internal systems, to its knowledge.
By the numbers
- October 9, 2026 - date Anthropic announced the restriction
- July - month the review began
- Four - broad categories of unintended model behavior Anthropic identified
Yes, but: Anthropic's claim that the detection tools blocked the reported behaviors came from replaying historical cases. It does not establish that live systems would prevent every unintended action, and the Philadelphia incident involved a delay in detection and reporting.
What's next: The restriction remains in place until further notice. Anthropic plans to move some evaluations offline, rebuild others to avoid live websites, tighten web-retrieval safeguards and increase monitoring.