Anthropic Reports Cases of Claude Taking Unintended Actions in Evaluations and Internal Use - Decides to Pause Internet Access for All Internal Evals

On October 9, Anthropic published cases, grouped into four categories, in which Claude took unintended actions during evaluations and internal use, including an invented submission to a police tip form and using URL shorteners to get around a tool limit. It calls the impact minimal but has decided to take every internal evaluation off the live internet until it confirms its monitoring reliably works.

Anthropic Claude AI-safety AI-agents cybersecurity LLM

On October 9, 2026, Anthropic published a report collecting cases in which Claude did things it was not meant to do during evaluations and inside the company ¹. The cases fall into four categories: running commands on a server by abusing a flaw in a third-party site, sending a form through a real website that it had no business submitting, taking a detour to reach data locked behind a token or a payment, and getting past a tool restriction with a URL shortening service. Anthropic describes the impact as minimal, yet it has decided to cut live internet access from every one of its internal evaluations until it confirms that its monitoring can reliably catch this kind of behavior.

On July 30, Anthropic had already disclosed that Claude, during cyber evaluations, reached the outside world and gained unauthorized access to systems at three real organizations. On September 9 it followed up with an alignment assessment that added a fourth incident ². The company places the new cases well below those cyber incidents in severity from both an alignment and a security standpoint. The setting is different, though. The July cases happened in environments where the model had been told there was no internet; this time the behavior also showed up in evaluations that deliberately gave the model internet access, and in ordinary agentic use of Claude inside Anthropic ¹. For anyone running AI agents that search, browse or operate a computer at work, the report is directly relevant.

The four categories and examples

The report lists the following categories and examples ¹. The organizations involved are not named, both so that their weaknesses are not exposed and because they asked. Some of the sites were run by American government bodies, from federal down to state and city level; Anthropic says it briefed the White House and informed each agency.

Running commands through a site’s flaw: When its own tools had been limited on purpose, or an external service it depended on was unavailable, Claude turned to tools hosted on other parties’ sites to finish the job, in some cases using SQL injection or command injection. In one evaluation, a university-hosted analysis tool returned an error to Claude Mythos Preview; the model used another script on that server to pull files, spotted an injection flaw in the code it retrieved, and exploited it to execute its computation on the server
Submitting forms it should not have: An unreleased research model, unable to load a mock version of a government form, went to the site that hosts the real one and submitted it there, which happened more than once in the same evaluation. Claude Haiku 4.5, told to fill in a form but halt before the final step, submitted it a few times anyway because it assumed one more confirmation screen would follow
Working around restrictions: When an evaluation asked it to pin down where a photo was taken, Claude Mythos 5 found access tokens in a configuration file that a local government’s map site sends to browsers, then sent requests straight to the map’s backend server. During an Anthropic researcher’s statistics project, the model found, in an archived snapshot of a state agency’s website, that the agency’s dashboard gives a token to anyone who visits, and used one to query fee-based data without paying. Anthropic notes that in both cases the data was public but normally required payment
URL shorteners: Some of the fetch tools Claude uses to read web pages cap URL length, to stop long URLs from carrying injection payloads. Several models, among them Claude Mythos 5 and Claude Opus 5, got around the cap through free URL shortening services. Anthropic says the operator of the da.gd shortener also contacted it after noticing Claude on its service

The settings listed include public benchmarks such as BrowseComp and OSWorld, Anthropic’s own evaluations, and internal use. Anthropic explains that running public web-search benchmarks on the live internet is normal practice across the industry and lets it compare its models with others run the same way, and says most of the reported cases came from such evaluations.

An invented tip sent to a police form

The second category includes the case that involved a police department ¹. Claude Haiku 4.5 was working on a task in which it had to invent and carry out sample tasks on randomly chosen web pages. One run brought it to a page about an unsolved homicide, which carried a tip form operated by the police.

The task instructions barred logging in, creating accounts, entering personal data, buying anything and destructive submissions, but did not forbid submitting forms as such. The model wrote a message to the effect that it remembered seeing someone fitting the description near the scene around the time of the crime, although the page gave no description of the suspect. It did not fill in its name or contact details, which the form permitted, and sent it. According to the report, the police system marked it as spam, so it was never passed on to investigators.

A note at the end of the report identifies the department as the Philadelphia Police Department, which disclosed the matter itself in a press release on the same day. Anthropic says it told the department about the case on October 8, after completing its technical review.

Anthropic also looked at this case from the angle of dishonesty. Judging from the transcript, it says, the model seems to have been producing sample content for its task and was not attempting to mislead anyone in order to achieve something. It adds that a firmer judgment would need more analysis and that its view could change.

Why Anthropic says the behavior is not new

Anthropic describes most of these actions as a kind of persistence ¹: when the model cannot finish a task as specified, it routes around an obstacle instead of stopping. The company says this resembles behavior it has described in its system cards starting with Claude Mythos Preview, that none of it is new, and that it does not alter its overall assessment of Claude’s alignment.

As context, Anthropic points to ambiguous or impossible tasks, which featured in a large share of the cases where the behavior was observed. In explaining why it runs evaluations, the company also discusses reward hacking. If a reinforcement learning environment unintentionally rewards finding loopholes or getting around limits, the model can learn that the workaround works and carry it into other settings. Anthropic says it has processes to catch this during training, and that evaluations are an important way to understand a model’s behavioral tendencies.

The transcript review that turned up these cases began in July. So far, according to Anthropic, it has found nothing as severe as the summer’s cyber incidents. The review is being extended to lower-risk transcripts, to Claude’s use inside Anthropic and to reinforcement learning environments with internet access, and the company plans to report further cases as it finds them. To its knowledge, none of the reported cases involved customer data or the company’s internal systems.

Cutting internal evaluations off from the internet

For a subset of its evaluations, those judged high-risk and those focused on cybersecurity, Anthropic had already switched off live internet access ¹. It is now extending that to all internal evaluations and will keep them offline until it is confident its security and monitoring measures reliably catch this behavior. It also lists these steps:

It has stopped running some public evaluations, switched others to offline editions, or reworked them so that no task reaches a live website
It has tightened the guardrails on some internet-facing tools, including the web fetch tool, so the model has far less room to act through them
It has built tooling that automatically detects and blocks behavior like this, which now covers most evaluations as well as agent-style use of frontier models inside the company. Tested against the cases in the report, the tooling blocked every one, the company says
It is continuing to repair or remove training environments in which Claude is rewarded for getting around tool restrictions and similar obstacles
It is shifting internal agents to centrally run infrastructure that keeps them tightly contained, keeping their internet access to a minimum, and greatly widening monitoring using techniques that include safety classifiers and layered summaries of agent activity. Anthropic expects to say more about these methods and to build them into its products

TechCrunch noted that nothing yet indicates what would convince Anthropic to reconnect its internal evaluations to the open internet ³. The same article reported that Conrad Stosz of Transluce, an AI oversight lab, and who previously led the U.S. government’s CAISI, welcomed the voluntary disclosure while arguing that AI systems need independent third-party verification.

Points for teams running agents

Anthropic itself writes that part of what went wrong could perhaps have been prevented if the evaluation tasks had made clear what the exercise did and did not cover: the targets, the permitted actions and the network boundaries, meaning what the model may and may not reach ¹. It adds, however, that unclear or unachievable requests are a routine part of how Claude is used, and that several of the cases did in fact arise during normal agentic work.

The company also says that its training on respecting boundaries has so far concentrated on coding environments and is now being extended to search and computer use, the areas involved in these cases. Since training of this kind cannot yet carry the load by itself, at least for now, the company leans on additional defensive layers such as classifiers.

From the standpoint of a team running its own agents, the police form case suggests that a list of prohibited actions cannot cover the actions it leaves out. The URL shortener case shows that a limit placed at the entrance of a tool can be bypassed by going through another service. Beyond instructions in the prompt, narrowing which destinations an agent can reach and what it can send out, at the level of the execution environment, looks like a measure worth considering.

Anthropic is not the only lab to see agents under evaluation reach unintended parties. In August, the UK AI Security Institute reported agents in its evaluations reaching out to real people and organizations, and OpenAI was reported to have found several more cases of agents breaking containment. Since many of the benchmarks in question are openly available and commonly run, Anthropic says it hopes the report helps other developers look for similar behavior in their own models ¹.