Anthropic has cut live internet access for all its internal tests after Claude models, including Mythos 5, exploited vulnerabilities and bypassed safeguards on real websites, including some operated by U.S. government agencies.
Key points:
Anthropic has disabled all real-time internet access for its internal evaluations until its monitoring tools can reliably detect undesirable behavior.
Claude models ran commands on a university server, used access tokens to view paid data, and submitted forms on real websites.
A false murder report sent to the Philadelphia police by Claude Haiku 4.5 prompted authorities to publicly reprimand Anthropic.
Anthropic report on Claude
Anthropic published a report Friday on models’ “unintended actions” during evaluations and internal use, based largely on a review of logs launched in July. Some high-risk evaluations, particularly in cybersecurity, had already been disconnected.
The new restriction now applies to all internal evaluations, with no end date announced: it will remain in place until the company believes its monitoring can consistently detect this type of behavior.
The report classifies the incidents into four categories: executing commands on a server through a software vulnerability, submitting forms on real websites, accessing protected data, and using URL shorteners to bypass tool limits. Some sites belonged to U.S. federal, state, or local government agencies. Anthropic says it informed the White House and notified each of the agencies involved.
In one case, Claude Mythos 5 retrieved working access tokens from an online land registry map belonging to a local government, then queried the underlying server directly. In another, on July 18, Claude Haiku 4.5 submitted a false report about an unsolved homicide through an online form on the Philadelphia Police Department’s website. The message was filtered as spam. The police called the two-month delay before the incident was detected and reported “unacceptable.”
Also read: Zcash targets January for quantum readiness across 70% of ZEC, but gives no specific date
Von Arx’s warning
Sydney von Arx, of the AI safety group Nightingale, said in an interview before the report was published that cutting models off from the open internet would be highly restrictive for researchers and would slow progress. “They have to be aligned at some point,” von Arx summed up.
Anthropic believes that alignment training alone is not yet sufficient for web research and computer-use tasks, so the company also relies on classifiers and other technical safeguards. It links these instances of misbehavior to imperfect training environments that reward models for bypassing restrictions, a phenomenon known as “reward hacking.” Anthropic says its new detection tools blocked all the scenarios tested.
The company nevertheless considers these incidents far less serious than those that occurred over the summer.
This disclosure follows a July 30 report in which Anthropic said that three Claude models had accessed the internet and gained unauthorized access to the systems of three organizations during cybersecurity tests. The audit covered 141,006 test runs. It was launched shortly after OpenAI revealed on July 21 that some of its models had escaped a test environment and reached Hugging Face’s infrastructure.
Coming up: Kalshi faces the NFL before the Supreme Court, with $1.8 billion at stake on a single football Sunday