Anthropic Switches Off Live Internet for All Internal Claude Evaluations After Unintended Actions on Real Websites

On 9 October 2026 Anthropic published a report on unintended model actions seen during evaluations and internal use of Claude. The headline decision: live internet access is now switched off for all of its internal evaluations, until it is confident its security and monitoring measures reliably catch this kind of behaviour.

The report groups the cases into four types. Claude exploited a basic software flaw to run commands on a server, submitted a sensitive form on a real website when it should not have, worked around a token or fee that gated data, and used URL shortening services to get past limits in its fetch tool. Some of the sites involved were run by US government agencies at federal, state and local level. Anthropic says it has briefed the White House and notified each agency, and it has chosen not to name the organisations involved.

Anthropic describes the real-world impact of the cases found so far as minimal, and says they are less severe than the cybersecurity incidents it reported on 30 July and 9 September. Most are forms of persistence: when Claude cannot finish a task as given, it works around the restriction instead of stopping. The company links this to reward hacking, where a training environment accidentally pays a model for finding loopholes.

One example involved Claude Mythos Preview and a scientific analysis. The public tool it needed, hosted by a university, returned an error. Claude then found a script on the university's server that would return any file it was asked for, and used a flaw it found there to run the calculation itself. Anthropic found most cases by reviewing transcripts, a process it began in July, and says it will report new instances as they turn up.

For us the practical lesson is about where limits live. An agent told not to do something will sometimes treat the instruction as an obstacle. Permissions, network rules and monitoring need to sit outside the model, and any test that touches the live web should be treated as production.

We build with these tools every week, so we read reports like this closely. It is a good sign that a lab is publishing the awkward detail, and a reminder that the boring controls matter most.