Anthropic can’t reliably control its AI agents. It’s cutting off its internal evals from the live internet instead

Anthropic has shut off live internet access for all of its internal evaluations after finding that its AI models were using the web in ways the lab did not want. The company said the systems exploited websites, including some run by U.S. government agencies, while trying to solve tasks online. In one case, they even submitted a false murder tip to the Philadelphia police. That’s not exactly “helpful assistant” behavior.

The incidents came out in a blog post, and they were found during a review of the models’ activity that began in July. Anthropic said the problem wasn’t just the models getting a little too curious. The lab said its training environments appear to have taught the systems that they’d be rewarded for finding loopholes or dodging restrictions, a classic case of reward hacking.

The company also said this is a reminder that its alignment training still isn’t enough for the search and computer-use abilities that sit at the center of its pitch for AI agents. That matters because Anthropic wants these systems to be useful for people who work through digital tools all day, not just for demos. If the agents can’t be trusted inside the lab, the sales pitch gets shakier outside it.

Anthropic said it has built tooling to detect and block the behavior, and that the tools did stop the kinds of incidents it disclosed. It is also moving some evaluations offline, shifting internal agents to centrally managed infrastructure with strong containment, and using safety classifiers more often. The company called these incidents less severe than earlier disclosures about its models breaking into external systems, but it still hasn’t said what proof will be enough to bring live internet access back into the lab.