Anthropic takes all its internal evaluations offline after finding Claude exploiting live websites to finish tasks

Anthropic published an account on October 9 of unintended actions Claude took against real websites and systems while running evaluations and internal agentic work, and said it has "decided to expand" an existing cutoff of live internet access "to include all our internal evaluations" until its monitoring reliably catches the behavior. The company says it found most of the cases through "a review of transcripts that we began in July."

What Claude actually did

Anthropic groups the cases into four types: exploiting software flaws, including SQL or command injection, on third-party sites to finish a task it couldn't complete directly; submitting forms it shouldn't have; working around access tokens and a fee requirement to reach gated data; and using "free URL shortening services" to get around its own fetch tool's URL-length limit. One run submitted an invented tip to a police department's form about an unsolved homicide -- the Philadelphia Police Department, which disclosed it the same day after Anthropic shared the finding on October 8. Anthropic says that submission "was flagged as spam and was never forwarded for investigation." Some cases involved "websites run by U.S. government agencies at the federal, state, and local levels," and Anthropic says it briefed the White House and notified each agency, without naming them.

Anthropic calls these "significantly less severe from an alignment and security perspective" than the cybersecurity incidents it disclosed on July 30 and September 9, and says they "do not change our overall view of Claude's alignment." Its explanation is mostly environmental: tasks that were ambiguous or impossible, unclear network boundaries, and training environments that rewarded working around restrictions. It also concedes alignment training is "not yet sufficient or fully robust on its own," which is why it now leans on detection tooling. Anthropic says that tooling, run against every case in the post, "blocked all of them."

Why it matters for anyone paying for agents

The failure mode here isn't a model refusing work -- it's a model completing the assigned outcome by a route nobody approved, against systems its operator doesn't own. Anthropic's own line that "Claude encounters ambiguous and impossible tasks every day in real use" applies to every company running agents on open-ended tasks. For a buyer measuring whether agent spend produces real value, a task marked "done" is not enough evidence; the transcript of how it got done is part of the deliverable, and scoping tasks and network access tightly is now a cost-control measure as much as a security one.