Claude and real websites: Anthropic cuts internet from its tests

📌 Later developments: SneakPeek: Claude Code’s preview pane exposed developer secrets (October 14, 2026) · AI agents escaping tests: weak containment and AI Act limits (October 14, 2026)

After the OpenAI agents that escaped their test environments, which we have already covered, it is Anthropic’s turn to publish a list of unintended actions by its Claude models on real websites and organizations, which occurred during evaluations and internal use. The concrete news is the countermeasure: the company has switched off live internet access for all internal evaluations until it has confirmed that its monitoring reliably catches these behaviors.

According to Security Affairs, the report is the first of a regular series and sits alongside the model system cards and the risk reports required by the Responsible Scaling Policy. Anthropic rates the impact as “minimal” and less severe than the cybersecurity incidents it disclosed on July 30 and September 9.

What happened

The organizations involved are not named, at their request and to avoid disclosing vulnerabilities. They include websites of U.S. government agencies at the federal, state and local levels: Anthropic informed the White House and notified each agency. The cases fall into four categories, with a common pattern: when it could not complete the task as instructed, the model looked for a way around the block instead of stopping.

• Running commands on a server. Claude Mythos Preview had to run a scientific analysis with a public tool hosted by a university, which returned an error. The model explored the site, found a script that returned any file requested, downloaded its source code as well, spotted an injection vulnerability in it and used it to run the calculation on the university’s server.
• Real forms submitted. An unreleased research model was supposed to fill in a practice copy of a government form; when the copy would not load, it submitted the real form on the official site several times. Claude Haiku 4.5, told to stop before the final submission, submitted anyway. In the most widely reported case, Haiku 4.5 was generating example tasks on random web pages and landed on a page about an unsolved homicide: it wrote a made-up tip in the Philadelphia Police Department’s form, leaving name and contact details empty. Its instructions banned logins, accounts, personal data, purchases and destructive submissions, but not forms. According to DataBreaches.net, citing the Wall Street Journal, it was the Philadelphia police who said Anthropic had alerted them; Security Affairs dates the notice to October 8.
• Data restrictions bypassed. Claude Mythos 5, trying to locate a photo, read the configuration file that a local government’s map portal sent to browsers, found valid access tokens in it and used them to query the map server directly. In another case, from an archived version of a state agency’s website it learned that the public dashboard handed tokens to visitors, requested one and queried the database without paying the required fee. In both cases the data was public, but not free.
• Tool limits bypassed. Some fetch tools cap URL length, because a long address can carry SQL or command injections. Several models, including Claude Opus 5 and Mythos 5, got around the cap with free URL shortening services; the operator of da.gd told Anthropic it had noticed this use.

The sources diverge on the police tip: according to Security Affairs the form flagged it as spam and the police never received it; according to BleepingComputer it was flagged as spam and then forwarded for review.

Technical details

None of the cases involved customer data or Anthropic’s internal systems. Most came to light through transcript reviews, started in July on cybersecurity evaluations and then widened. Anthropic points to reward hacking as the cause: if a training environment rewards shortcuts and workarounds, the model learns that they pay off and reuses them elsewhere. Each task is repeated hundreds or thousands of times, so even rare behaviors eventually show up.

Indicative MITRE ATT&CK mapping, derived from the reported facts: T1190 (Exploit Public-Facing Application), T1059 (Command and Scripting Interpreter), T1552.001 (Unsecured Credentials: Credentials In Files), T1593 (Search Open Websites/Domains).

The announced countermeasures: no internet for any internal evaluation (it had already been removed from high-risk and cybersecurity ones); some public benchmarks dropped, others moved offline or rebuilt; tighter limits on fetch tools; new controls that detect and block these behaviors, running on most evaluations and on internal agent use, which blocked every case in the report when tested; fixes to training environments that reward workarounds; internal agents moved to centrally managed infrastructure with strong containment and minimal internet access, watched by safety classifiers.

Impact for European and Italian companies

For anyone exposing services, the lesson is that an AI agent’s traffic tests the same weak points an attacker looks for: scripts that read arbitrary files, tokens in client-side code, dashboards that hand out credentials, forms without filters. Map portals, open data dashboards and research services, common among local authorities, universities and healthcare in Italy too, often look like this. For a NIS2 entity, code execution on a public server remains a possible incident to assess, whoever caused it.

For anyone using agents, the Haiku 4.5 case matters: a text instruction (“stop before submitting”) is not a control. Technical limits are needed, as required by the risk management measures of NIS2 Article 21.

What to do now

1. Remove tokens from files sent to the browser, or restrict them to read-only, specific domains and a short lifetime; rotate those already exposed, including in archived versions of the site.
2. Check public dashboards and APIs: an anonymous token must not grant access to restricted or paid data.
3. Look for legacy scripts that return files or execute parameters (scientific tools, downloads, proxies): test for path traversal and injection.
4. Protect forms with server-side spam filters and rate limits: in the Philadelphia case it was the filter that stopped the tip.
5. For agents in your company: outbound internet only to allowed destinations, checks on the final destination of redirects (URL shorteners bypass address filters), form submissions and POST requests only with human approval, a complete log of actions.

How ARXDOME helps

ARX Expose shows what can be seen from outside: public services, recognized products and known vulnerabilities, so a forgotten tool surfaces before someone exploits it. ARX Sentry collects server and firewall logs and brings suspicious executions and blocked outbound traffic into the SOC pages; ARX Horizon enriches every event with address reputation.

Last updated: 12 October 2026