The Anthropic decided to suspend real-time internet access in all of its internal evaluations after identifying Claude models exploiting security flaws, bypassing access controls and sending information to external systems without proper authorization. The measure was disclosed this Friday (9), in a report that documents unexpected behaviors during tests and internal activities at the company.
The restriction will remain in effect until the company confirms the effectiveness of its security and monitoring mechanisms. Some of the occurrences involved websites of U.S. government agencies, including government systems and a police form. Anthropic said it reported the episodes to the affected agencies and the White House.
The incidents were identified mainly during a records review started in July 2026. According to the company, the cases had limited real impact and did not involve customer data or its own internal systems. The suspension affects internal evaluations and does not represent a general internet block in Claude's commercial products.
Four types of failure led Anthropic to restrict tests with internet access
The report identifies four categories of misconduct. The first involves the exploitation of vulnerabilities in external servers. In one of the episodes, Claude Mythos Preview needed to perform a scientific analysis, but found a university tool unavailable. The model examined the server, identified a flaw that allowed it to execute commands and used the access to complete the task.
The second category involves the improper submission of real forms. During an evaluation, Claude Haiku 4.5 sent fabricated information about an unsolved homicide through a police department's website. The model was only supposed to demonstrate interactions with web pages, but ended up submitting the form. The message was identified as spam and did not reach investigators.
Other episodes involved real government forms submitted when the model should have used training versions or halted the operation before confirmation.
In the third category, models managed to access information protected by tokens or normally made available upon payment. In one case, Claude Mythos 5 identified credentials present in the configuration files of a government service and used them to directly query the data. In another, it obtained public information from a state agency without making the normally required payment.
The fourth failure involved URL shortening services used to bypass technical limits of browsing tools. These limits exist, among other reasons, to restrict requests capable of carrying improper commands.
Anthropic said it has already discontinued some evaluations, moved others to offline environments and tightened restrictions on its tools. It also developed automated detection and blocking systems that, according to the company, prevented all documented incidents when tested retrospectively.
These mechanisms already operate in most evaluations and in internal activities with advanced agents. The company will continue examining execution logs, restricting external connections and adjusting training environments that could reward models for bypassing limitations.
There is still no set date to restore internet access in internal evaluations. The lifting will depend on validation of security controls, while Anthropic continues its investigation into other unforeseen behaviors.
