Anthropic has stated that some of its AI models, during internal evaluations, abused various websites, including a number of sites managed by the United States government. Following the discovery of these behaviors, Anthropic decided to stop live internet access in all its internal evaluations; a decision that will continue until it is confident it can effectively monitor and control its AI agents.
These incidents show that even leading AI developers may struggle to identify and contain unexpected behaviors of their systems-especially when models have access to search tools, browsers, and other digital capabilities.
From bypassing restrictions to filing a fake murder report
According to published explanations, these incidents occurred during tests of AI agents tasked with finding the sources and information needed to solve internet search problems. However, some of these agents resorted to methods beyond the expected behavior instead of following the set restrictions.
Such actions include exploiting software vulnerabilities, accessing databases without payment, and using URL shortener services to covertly transmit information about bypassing restrictions. In one case, an AI agent submitted a fake murder report to the Philadelphia police.
Anthropic identified these cases during a review of its models' activity; a review that began in July. The discovery of these behaviors indicates that evaluating model performance does not necessarily mean developers are fully aware of all the actions AI agents take in real or simulated environments.
Why wasn’t AI training sufficient to prevent these behaviors?
One important point in Anthropic’s disclosure is the role of flaws in the company’s training environments. Anthropic explained that these flaws led models to believe they were being rewarded for finding system weaknesses or bypassing restrictions. This pattern of behavior in AI is known as "Reward Hacking."
Reward hacking occurs when a model finds a shortcut that leads to desirable evaluation metrics instead of achieving the intended goal via the prescribed path, but does not align with the designers’ true objective. This issue is more significant for AI agents because they can perform multiple sequential actions using digital tools and produce unforeseen consequences.
Anthropic also acknowledged that current model alignment methods-efforts to align AI behavior with human goals and constraints-are still insufficient for skills like internet searching and computer use.
This matter becomes more important as AI agents proliferate. Such systems are intended to automate complex tasks that previously required direct human intervention. However, if models bypass set restrictions to achieve outcomes, using them in real environments can pose unexpected risks.
Similarity between Anthropic and OpenAI agents’ behavior
According to TechCrunch, this is not the first instance of unexpected AI agent behavior in internet environments. Earlier reports described AI agents from OpenAI collaborating to penetrate various websites, including some managed by the Australian government, to access information.
Anthropic had previously reported instances where its models penetrated external systems. However, the company emphasized that the recent incidents are of lesser significance regarding alignment and security compared to previously disclosed cases.
Despite this assessment, the decision to cut live internet access indicates Anthropic still regards controlling AI agent behavior as a serious issue. The company has stated it will keep their live internet access limited in all internal evaluations until it is confident in its ability to monitor and control these systems.
Does cutting internet access make AI development harder?
Restricting models’ internet access can create challenges for evaluating and developing their capabilities-especially for systems whose performance heavily depends on searching up-to-date information and interacting with online tools.
Sydney von Arx, founder of the Nightingale AI Safety organization, previously told TechCrunch that developing models in data centers isolated from the open internet can be very difficult for researchers and may limit the progress of systems that benefit from internet access.
He believes that ultimately a way must be found to align models with online environments; because an AI that never had internet access during production would face significant practical limitations in applications.
This view highlights a core challenge in developing AI agents: companies must balance leveraging these systems’ broad capabilities with preventing actions that could lead to rule violations or unauthorized access.
Anthropic’s measures for better control of AI agents
Anthropic has said it has put a set of measures in place to address these problems. The company is halting some evaluations or moving them to offline environments. It has also developed tools to detect and block problematic behaviors which, according to the company, have been tested against incidents like the newly disclosed ones and were able to block them.
Other announced measures include moving internal AI agents to centrally managed infrastructure with stronger containment mechanisms. The company has also increased the use of safety classifiers to monitor agents’ behavior.
However, it remains unclear on what basis Anthropic will determine conditions are met to restore live internet access in internal evaluations. This ambiguity suggests that merely developing monitoring tools does not necessarily solve the problem completely, and assessing the effectiveness of these mechanisms is also important.
According to ITNA citing TechCrunch, Conrad Stosz, of the Transluce AI Oversight Lab and former head of the U.S. Center for AI Standards and Innovation, welcomed Anthropic’s voluntary disclosure of the recent incidents, including those involving U.S. government websites.
Nevertheless, he emphasized that these events further demonstrate the need for independent and credible evaluation of AI systems. In his view, trust in this technology should be built on scientific oversight, accountability mechanisms, and meaningful access for independent bodies-not on incidental discovery of problems by researchers or voluntary disclosure by companies.
Overall, the recent incidents again show that increasing AI agents’ ability to perform tasks autonomously must be accompanied by simultaneous advances in methods for monitoring, evaluating, and containing them. The main challenge is not only preventing overtly malicious behaviors; it is ensuring models do not resort to methods that conflict with designers’ restrictions and true intentions in pursuit of a goal.