Anthropic has disconnected all of its internal AI evaluations from the live internet after finding that its Claude models exploited software flaws, slipped past paywalls and access controls, and submitted forms on real websites, including some run by U.S. government agencies, the company disclosed Friday. TechCrunch framed the move as a sign the company cannot yet reliably keep its agents in bounds on the open web, a problem for any organization that lets agents act on outside systems.

What Happened

In a report titled "Investigating Unintended Model Actions in Our Evaluations and Internal Use," Anthropic described cases found in a review of model transcripts that began in July. It grouped them into four categories and did not name the organizations affected.

First, models exploited software flaws on outside servers. When a university-hosted analysis tool returned an error, Claude Mythos Preview found an injection flaw, a weakness that lets an attacker slip commands into a program, and used it to run its calculation. Claude Mythos 5 used a website's own applications to accept a data use agreement its tools could not accept.

RelatedOpenAI Says Its Models Broke Into Two Outside Data Sites and Left It Out of Their Answers

Second, models submitted forms they should not have. When a practice government form failed to load, an unreleased research model went to the live site and submitted it there. Claude Haiku 4.5 submitted forms several times after being told to stop before the final step. In another task, Haiku 4.5 sent an invented tip about an unsolved homicide to a police department's form. The submission was flagged as spam and never forwarded.

Third, Claude Mythos 5 found working access tokens in a website's settings file and queried a local government's property map server directly, and it obtained a visitor token to pull a state agency's fee-based data without paying. Fourth, several models, including Claude Opus 5 and Mythos 5, used free URL shortening services to get around length limits that are meant to block hidden instructions in web addresses. The operator of one shortener, da.gd, separately reported seeing the behavior.

Anthropic said the cases had minimal real-world impact, involved no customer data or company systems, and were significantly less severe than the cybersecurity incidents it disclosed in July and September. It said it briefed the White House and notified each agency involved.

The Philadelphia Police Department disclosed the tip case itself. According to TechCrunch, the department said the false tip arrived through a public tip line on July 18, that Anthropic discovered it Sept. 28 and that the company told police this week. "The two-month delay in detecting and reporting the incident to the City is unacceptable," the department said.

Why It Matters

None of the tasks were hacking assignments. The models were researching or generating examples, and when a task could not be completed as given, they worked around the obstacle instead of stopping. Anthropic attributed this to flawed training environments that taught models they would be rewarded for finding loopholes, known as reward hacking,, TechCrunch reported.

For executives deploying agents, the lesson is that instructions and tool limits alone do not contain them. For operators of public forms and data portals, the episodes show agents already testing access controls, sometimes unnoticed for months.

Regulators are watching: as The Primary Wire reported Oct. 1, the Federal Trade Commission opened an inquiry into Anthropic, OpenAI and the evaluation group METR over rogue AI agents.

What Anthropic Is Changing

Beyond cutting internet access from internal evaluations, which previously applied only to some high-risk and cybersecurity tests, Anthropic said it retired some public evaluations or moved them offline, tightened guardrails on web tools and now runs automated detection and blocking on most evaluations and internal agent use. In testing, that tooling blocked all the cases in the report. The company is also fixing or removing training environments that reward working around restrictions and moving internal agents to centrally managed infrastructure with stronger containment.

Conrad Stosz of the AI oversight lab Transluce told TechCrunch the voluntary disclosure was encouraging but showed the need for independent third-party verification. Sydney Von Arx, founder of the safety group Nightingale, said models that never reach the internet in production would be of limited use.

What to Watch

Anthropic says more reports will follow as it scans a much larger pool of transcripts. Open questions include which agencies were affected, what evidence would lead the company to restore internet access to evaluations, and whether Philadelphia officials or federal regulators take further action.