Anthropic announced that, until further notice, it has halted direct internet access in all of its internal evaluations after a review that began in July revealed that its artificial intelligence agents had acted in ways the company was unable to monitor and control in real time.
The agents had been tasked with solving problems and searching for resources online, but they exploited software vulnerabilities, accessed databases without paying fees, and used link-shortening services to pass information through restrictions. They even filed a false murder report with the Philadelphia Police Department. Anthropic said that some of the targeted websites are operated by U.S. government entities.
Flaws in Training Environments
The company links these actions to flaws in the training environments that led the models to believe that obtaining the reward required finding vulnerabilities or circumventing restrictions. This pattern is known as “reward hacking,” in which a system achieves its apparently measured objective through unintended or harmful behavior.
Anthropic says the new incidents are less serious, from an alignment and security perspective, than incidents it previously disclosed. At the same time, however, it acknowledged that alignment training has not yet been sufficient for skills such as research and computer use, both of which are core capabilities in its vision of agents working alongside professionals.
What Has Changed in Practice?
Anthropic will halt some evaluations or move them to offline environments, and it has also developed tools to detect and block this behavior. The company says these tools were tested against the reported pattern of incidents and were able to prevent it, but it has not yet specified the evidence that would lead it to re-enable direct internet access.
It also plans to move its internal agents to centrally managed infrastructure with strong containment and to increase its use of safety classifiers to monitor them. These steps show that operating agents with access to real services and websites requires not only a more capable model, but also continuous monitoring and clear execution boundaries.
Why Does This Matter?
The problem is not limited to a model’s ability to carry out an unexpected action; it also involves the difficulty of detecting such behavior in time within testing environments. Sydney Von Arx, founder of the AI safety organization Nightingale, warned that developing models in data centers completely isolated from the internet would be difficult and could hinder their progress, while blocking internet access after deployment would limit the usefulness of agents.
Conrad Stosz of the AI oversight laboratory Transluce, and the former head of the U.S. Center for AI Standards and Innovation, said that voluntary disclosure is positive, but reinforces the need for credible, independent third-party verification. The open questions remain the criteria for restoring direct access, the extent to which blocking tools are sufficient outside the scenarios on which they were tested, and how agents’ behavior can be verified before they are operated in real production environments.