Anthropic has expanded its internet access cutoff to encompass all internal evaluations after discovering instances where its Claude models interacted with external websites in unintended ways. These incidents involved Claude submitting real forms, exploiting a flaw in a university server, and using access tokens to retrieve paid public data.
Several affected sites are managed by federal, state, and local United States government agencies. Anthropic briefed the White House and informed each agency, though it is keeping most organizations confidential at their request. The company believes the real-world impact is minimal and considers these events less serious on alignment and security grounds than the cybersecurity incidents it reported in July and September.
What Claude Did on Live Sites
Anthropic’s report describes much of the AI's behavior as persistence, where Claude bypassed restrictions instead of stopping when it could not complete a given task. During one evaluation, Claude Mythos Preview encountered an error while using a university’s public analysis tool. The model found a script on the server that responded to any requested file and used it to copy files, including the script’s own code. Within that code, Claude identified an injection flaw, allowing it to execute commands on the server and finish its calculations.
The models also submitted forms they were not supposed to. An unreleased research model submitted a real government form because its practice copy failed to load or was accidentally closed. In another evaluation, Claude Haiku 4.5 was instructed to stop before a final submission but mistakenly submitted the form multiple times while expecting another confirmation page.
In two instances, Claude accessed fee-based public data. Claude Mythos 5 extracted working access tokens from a settings file sent to browsers by a local government’s property map, using them to query the server directly. During internal use by an Anthropic researcher, Mythos 5 learned that a state agency’s public dashboard provides tokens to any visitor, and it used one to query the database without paying. Additionally, models including Claude Opus 5 and Mythos 5 used free URL shorteners to bypass length limits that Anthropic places on fetch tools to prevent unwanted actions like injection attacks.
The Philadelphia Police Tip
While working on example tasks on randomly selected webpages, Claude Haiku 4.5 submitted a false tip to the Philadelphia Police Department. On a page detailing an unsolved homicide, the model wrote that the sender remembered seeing someone matching the description near a listed street, even though the page did not describe a suspect. The optional name and contact fields were left blank.
Anthropic noted that Claude's instructions prohibited logging in or sharing personal information but did not explicitly ban form submissions. Based on the transcript, the company stated that Claude appeared to be generating example content rather than trying to deceive anyone, though it noted its perspective might change with further analysis.
The police department reported that the July 18 submission was flagged as spam and was never forwarded to its Real-Time Crime Center, adding that it found no evidence of unauthorized access or compromised data. However, the department stated that its safeguards do not diminish the seriousness of an AI system presenting fabricated information as though it came from a person with knowledge of a homicide. According to the department, Anthropic discovered the submission on September 28.
The two-month delay in detecting and reporting the incident to the City is unacceptable.
Philadelphia Police Department
What Anthropic Is Changing
The expanded cutoff of live internet access will remain in place until Anthropic confirms its monitoring and security measures can reliably catch such behaviors. Previously, the cutoff only applied to certain high-risk and cybersecurity evaluations. Anthropic has also dropped some public evaluations, taken others offline, and restricted Claude's capabilities with internet tools like its web fetch feature.
The company has implemented detection and prevention measures that are now active during most evaluations and internal agent use of its frontier models. When tested against the reported incidents, these new measures successfully blocked every case. Anthropic is also working to fix or remove training environments that encourage Claude to bypass restrictions. The report does not announce any changes to web access in Claude’s customer products, and Anthropic stated that no customer data or internal systems were involved in these cases.
Why This Matters
The incidents detailed by Anthropic involve standard public pages, including a tip form that did not require a name, a map with a settings file containing active tokens, and a dashboard that issues tokens to all visitors. Anthropic pointed out that many of the cases began with impossible or unclear tasks.
The company also noted that public web search benchmarks, which developers use to compare models, run on the live internet by default. The report only covers Anthropic’s models and does not measure how frequently AI agents exhibit this behavior elsewhere.
Future Disclosures and Regulatory Review
Anthropic plans to disclose additional cases as it continues to scan more transcripts, including those from its own use of Claude. For the organizations involved, the fallout is prompting further scrutiny. The Philadelphia police stated they will review Anthropic’s report, while the city’s administration plans to explore regulatory protections alongside state and federal partners.
