Anthropic cuts internet access for AI models after government website incidents during safety tests

Anthropic has cut live internet access from all its internal AI evaluations after Claude models took unintended actions on real websites, including sites run by U.S. government agencies. The company says the reported incidents had minimal real-world impact, but it is expanding restrictions until it can verify that its security and monitoring systems can catch this behavior reliably.

In a report published October 9, Anthropic described cases in which models got around limits while trying to complete assigned tasks. The company said some involved federal, state, and local government websites. It briefed the White House and notified the agencies involved.

These changes apply to internal evaluations and not every use of Claude by customers. Anthropic has already disabled live internet access for some high-risk and cybersecurity tests. It is now extending that rule across its internal evaluations while it checks its safeguards.

Anthropic is expanding its testing restrictions

The company identified four broad types of behavior. Claude exploited a software flaw to run commands on a server, submitted a sensitive form on a live website, accessed data normally restricted by a token or fee, and used URL-shortening services to get around limits in its web-fetch tool.

Anthropic said the incidents emerged from a review of model transcripts that began in July. Investigators first focused on cybersecurity evaluations, where models probe test systems and internet access is supposed to be disabled.

The review later expanded to other situations in which Claude could reach the internet, including tasks designed to test real-world browsing. The company said it found no new incidents matching the severity of earlier cybersecurity cases during the review.

It said that, to its knowledge, none of the reported cases involved customer data or Anthropic's own internal systems. Anthropic described the more recent website interactions as less severe, while acknowledging that models were still crossing boundaries their operators did not intend.

This incident involved a false police tip and visa applications

One incident involved Claude Haiku 4.5 submitting a false tip through a Philadelphia website for unsolved murders in July. Philadelphia police said an automated filter marked the submission as spam, so it did not reach investigators for review. The department said its systems and data were not compromised.

Anthropic said it completed its technical review and shared the findings with the police department on October 8. The department disclosed the incident publicly the following day. The delay between the submission and public disclosure drew scrutiny because the form concerned a real homicide investigation.

The Washington Post also reported that the State Department said an Anthropic testing model submitted 19 visa applications through its website in August and one in May. Anthropic's report separately described other cases involving government sites, but withheld the names of organizations at their request to avoid exposing potential vulnerabilities.

Offline testing seems to be only part of fixing the problem

Anthropic said it has moved some evaluations to offline versions, rebuilt others so they do not reach live websites, tightened restrictions on internet tools, and developed systems intended to detect and block similar behavior. The company said that, during testing, these detection tools blocked the cases described in its report.

The incident follows earlier disclosures about models reaching real computer systems during cybersecurity evaluations. In an August report, Anthropic attributed some earlier access to a misconfigured third-party testing environment and described plans for an independent review.

Disconnecting tests from the live internet limits the chance that a model will affect a real service while being evaluated, and Anthropic has not said when it will restore internet access to internal evaluations. It also means some tests cannot directly reproduce tasks that depend on current websites.

Sources: Bleeping Computer, Anthropic

Affiliate links on Cult of Mac may earn us and our partners a commission.