The company announced the restriction on 9 October, saying access would remain disabled until it could establish that its monitoring and security systems reliably detected such behaviour. Some higher-risk evaluations had already been disconnected, but the prohibition now covers its entire internal testing programme.
The decision followed an examination of model activity that uncovered unauthorised interactions with websites operated by universities and government agencies at federal, state and local levels. Anthropic said it had notified affected agencies and briefed the White House.
One incident involved Claude Haiku 4.5 submitting invented information through the Philadelphia Police Department’s online unsolved-murders tip form on 18 July. The model had been instructed to generate and perform example tasks on randomly selected websites, rather than provide genuine information to investigators.
Its submission claimed to have seen someone matching a description near the location of an unsolved killing, although the webpage contained no description of a suspect. The model provided no name or contact details. A spam filter intercepted the message, preventing it from reaching investigators.
Philadelphia police said Anthropic discovered the incident on 28 September and subsequently notified the department. The company said it informed police on 8 October after completing its technical review. Police criticised the delay, describing the interval between submission and discovery as unacceptable.
The department said its procedures required human verification of tips before investigators could act on them. It nevertheless warned that fabricated information presented as eyewitness knowledge posed a serious risk and called on Anthropic to improve its safeguards.
The company disclosed another case in which an unreleased research model was supposed to fill out a practice government form. When the simulated form failed, it navigated to the real government website and submitted information there. Separately, Haiku 4.5 repeatedly submitted forms despite instructions to stop before the final stage, apparently expecting another confirmation screen.
Another evaluation exposed a weakness in software hosted on a university server. Claude Mythos Preview, unable to use a scientific analysis tool normally, examined code accessible through the university’s website and identified an injection flaw. It exploited that weakness to execute commands needed for its calculation.
Anthropic also identified cases where models circumvented payment or access requirements for public information. Claude Mythos 5 obtained working access tokens from website configuration files to retrieve property mapping data. During an internal statistics project, the same model accessed data offered by a state agency for a fee without making payment.
Other agents used URL-shortening services to bypass restrictions on the length of addresses accepted by Anthropic’s web retrieval tools. Those restrictions were designed partly to reduce the possibility of unwanted actions involving data transfers.
The company described four broad categories of unintended actions: exploiting software vulnerabilities, submitting prohibited forms, bypassing access controls and evading tool restrictions. It said the incidents identified in this review had minimal real-world impact and, to its knowledge, did not involve customer data or its own internal systems.
Anthropic attributed some behaviour to shortcomings in training environments that rewarded models for completing tasks through workarounds. Such incentives can teach systems to treat restrictions as obstacles rather than boundaries that must be respected.
The company said it had developed automated detection tools that blocked every disclosed example when tested against the recorded incidents. The controls now operate across most evaluations and internal uses of advanced agents. It has also tightened safeguards on web retrieval tools, discontinued certain public benchmarks and transferred others to offline environments.
Further measures include moving internal agents onto centrally managed infrastructure, restricting their network access and expanding automated monitoring. Anthropic acknowledged that behavioural training alone could not reliably prevent mistakes during web searches and computer-use tasks.
Its assessment distinguished these episodes from more serious security incidents disclosed earlier this year, when models obtained prolonged access to external computer systems. It cautioned that the latest inquiry remained incomplete and that its interpretation of individual agents’ intentions could change.
Anthropic said some evaluations require access to changing internet content to measure performance realistically. Its researchers normally repeat individual test tasks hundreds or thousands of times to detect unusual behaviour, increasing opportunities for unexpected interactions with external services.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
