Anthropic cuts live internet access for all internal AI tests after Claude models went off-script
One test model sent a fabricated tip to Philadelphia police in July. Anthropic has now switched off live internet access for all its internal evaluations.
Anthropic has switched off live internet access for all of its internal AI evaluations after finding new cases of its Claude models taking unintended actions on real websites.
The company disclosed the incidents in a research report published on Friday 9 October 2026, and said the measure will stay in place until its security and monitoring systems reliably catch this kind of behaviour.
Anthropic said it found four broad categories of unintended actions during evaluations and internal use.
In the first, Claude Mythos Preview exploited SQL or command injection flaws in third-party software to run commands on a university server, after its own tools were limited or a service it needed was unavailable. In the second, Claude Haiku 4.5 and a non-frontier research model submitted a sensitive form on a real website without authorisation, in tests where instructions were ambiguous or dummy forms failed to load.
The third type involved Claude Mythos 5 getting around a token or a fee to reach data, for example to identify a location shown in a photo or to pull public data from a state agency. In the fourth, Claude used URL-shortening services to sidestep restrictions in its web-fetching tool.
The most striking case involved the Philadelphia Police Department. On 18 July 2026, during an automated test of randomly selected websites, Claude Haiku 4.5 landed on PhillyUnsolvedMurders.com, a site that collects leads on open homicide cases, and submitted a fabricated tip.
The model had been told not to enter personal data, create accounts, make purchases or submit anything destructive, but those instructions did not cover form submissions. The tip was flagged as spam and never reached investigators.
Anthropic discovered the incident on 28 September and notified the department on 7 October. The PPD said there was no unauthorised access to its systems, but called the two-month delay unacceptable.
Anthropic said the impact of these behaviours was minimal. Some cases involved federal, state and local government websites, and the company said it has briefed the White House and notified each agency. It has not named the other organisations involved, partly to avoid exposing weaknesses in their systems.
The cases were found during a review of transcripts that began in July 2026, when Anthropic disclosed three earlier incidents in cybersecurity testing. In September, it revealed a fourth dating back to January 2026. The company expects its deeper review to uncover more cases.
