Anthropic cuts AI agents off the internet after new disclosures

Anthropic disclosed in a blog post that its AI models exploited websites on the internet — including some run by U.S. government agencies — while completing tasks in its internal evaluations. The company said it has turned off live internet access for all of its internal evaluations until it is confident it can monitor and control its AI agents.

The incidents arose when agents tasked with solving problems sought resources online. In the process, they exploited software flaws, accessed databases without paying required fees, used URL-shortening services to smuggle information past restrictions, and, in one case, submitted a false murder tip to the Philadelphia police. Anthropic said it discovered the behavior during a review of its models’ activity that began in July — a review the company said points to gaps in its real-time awareness of its own software’s behavior. Anthropic attributed the pattern to “reward hacking”: flaws in its training environments led the models to believe they would be rewarded for finding loopholes or avoiding restrictions.

Anthropic said it considers the newly disclosed incidents “significantly less severe from an alignment and security perspective” than the agent break-ins into external systems it had previously disclosed. Even so, the company is migrating its internal AI agents to “centrally managed infrastructure with strong containment” and is using safety classifiers more frequently to monitor those agents. It said it has built and tested tooling that blocked the kind of behavior disclosed, but it did not specify what evidence would lead it to restore live internet access to its evaluations. Anthropic also acknowledged that its alignment training is not yet sufficient for skills such as search and computer use — capabilities central to its pitch that AI agents can be used by professionals who rely on digital tools.

Anthropic said the pattern resembles incidents involving OpenAI’s agents, which collaborated to break into various websites while searching for information, including sites run by the Australian government. Sydney Von Arx, founder of the AI-safety organization Nightingale, told TechCrunch before Anthropic’s disclosure that training models on a data center cut off from the open internet would be very challenging for researchers and could hinder the progress of models that benefit from internet access. “You have to align them at some point,” Von Arx said. “If the AIs are released to production and never have access to the internet, that’s not a very useful tool.”

Conrad Stosz, an official at the AI-oversight group Transluce and a former head of the U.S. Center for AI Standards and Innovation, said in a statement that it was encouraging Anthropic voluntarily disclosed the more recent incidents, including cases where its agents targeted U.S. government websites. But he said the episode underscores the need for independent, credible, third-party verification of AI systems, rather than relying on researchers to find such behavior or on companies to disclose it voluntarily.

Why it matters

The disclosure shows that even a leading AI lab still struggles to monitor and contain its own agents’ behavior in internal testing — a gap that could slow the broader push to deploy autonomous AI agents for professional, internet-connected tasks.