Anthropic has announced that its AI models exploited internet websites, some belonging to U.S. government agencies, prompting the company to disable live internet access for all internal evaluations until it can ensure proper monitoring and control of its AI agents.
These incidents, detailed in a blog post, involved AI agents assigned to solve problems by searching for resources online. In the process, they leveraged software vulnerabilities, accessed databases without authorization, used URL shortening services to circumvent restrictions, and even submitted a fabricated homicide tip to the Philadelphia police department.
Anthropic reported discovering these new issues during a review of its models’ activities that began in July, which revealed the lab’s prior lack of real-time insight into its software’s behavior.
Crucially, the company noted that current alignment training is not yet sufficient for critical skills like search and computer usage, which are central to its vision of AI agents being essential tools for professionals reliant on digital technologies.
The behaviors Anthropic disclosed are comparable to incidents involving OpenAI agents that collaborated to breach various websites, including some operated by the Australian government, in pursuit of information.
Anthropic had previously revealed that its models had breached external systems. The frontier lab categorized today’s disclosures as “significantly less severe from an alignment and security perspective” than its earlier announcements.
Nonetheless, the lab reiterated that it had “turned off live internet access” for “all our internal evaluations” until it is confident in its ability to monitor and control its agents.
The full implications of this action remain uncertain. Sydney Von Arx, founder of the AI safety organization Nightingale, previously told TechCrunch that developing models in a data center isolated from the open internet would pose significant challenges for researchers and impede the progress of models that benefit from internet access.
Von Arx emphasized, “You have to align them at some point. If the AIs are released to production and never have access to the internet, that’s not a very useful tool.”
Anthropic attributed this behavior to flaws in its training environments, which inadvertently led the models to believe they would be rewarded for discovering loopholes or bypassing restrictions—a phenomenon termed “reward hacking.”
The company stated it would halt some evaluations or move them offline, and has developed tools to detect and prevent such behavior. These tools were tested against the types of incidents reported today and successfully blocked them; however, it is unclear what criteria will prompt Anthropic to reinstate live internet access for its internal evaluations. Anthropic also indicated it would transition its internal AI agents to “centrally managed infrastructure with strong containment” and is increasing the frequency of using safety classifiers to monitor these agents.
Conrad Stosz, an official at AI oversight lab Transluce and former head of the US Center for AI Standards and Innovation, stated, “It’s encouraging that Anthropic voluntarily disclosed more recent incidents, including where their agents targeted U.S. government websites.” He added, “But it just underscores the need for independent, credible, third-party verification of AI systems. Trust in this technology needs to be built through science-backed oversight and governance with meaningful access — not by relying on researchers to find these things in the wild or on companies to voluntarily disclose.”