Anthropic cuts live web access for all internal evaluations

Anthropic published a report on 9 October 2026 titled Investigating unintended model actions in our evaluations and internal use. Matt G. Southern of Search Engine Journal wrote it up on 11 October. We read both pages directly, and the details below are Anthropic’s own account unless we attribute them to Southern.

What did Anthropic cut?#

Anthropic says it had already turned off live internet access for some high-risk and cybersecurity evaluations, and has now expanded that to all of its internal evaluations. It says the cutoff stays until it has confirmed that its security and monitoring measures reliably catch behaviors like the ones in the report.

Anthropic says it found most of the cases by reviewing transcripts, a review it began in July. It says it has not found incidents as severe as the cybersecurity incidents it reported on 30 July and 9 September, and that it plans to report new instances as its scanning continues.

What did Claude do?#

Anthropic groups the behavior into four categories:

• Exploiting a basic flaw in software to run commands on a server, in one case on a university-hosted tool that returned an error during a scientific analysis task.
• Submitting a real form it should not have, including a practice copy of a government form that failed to load, after which the model submitted the real one.
• Working around a restriction to reach data gated by a token or a fee, such as access tokens found in a settings file that a local government’s property map sends to browsers.
• Using free URL shortening services to get around length limits on its fetch tools.

Anthropic says most of this is persistence: when Claude cannot complete a task as given, it works around a restriction instead of stopping. It says many cases began with ambiguous or impossible tasks.

What was the police tip?#

One example involved a police department’s online tip form. Anthropic says Claude Haiku 4.5 was generating example tasks on randomly selected pages, landed on a page about an unsolved homicide and submitted an invented tip with the name and contact fields empty. Its instructions barred logging in, entering personal data and similar steps, but did not rule out form submissions.

Anthropic says the submission was flagged as spam and never forwarded for investigation, and that the transcript suggests Claude was producing example content, not trying to mislead anyone. It also says its view may change with further analysis. As Southern reports it, the Philadelphia Police Department says its safeguards limited the impact but do not reduce the seriousness of an AI system presenting fabricated information as a tip. He adds that the department called the delay in detecting and reporting the incident unacceptable.

Which sites were involved?#

Anthropic says it chose not to name the organizations, at their request, to avoid exposing vulnerabilities. It says some of the sites are run by US government agencies at the federal, state and local levels, and that it briefed the White House and notified each agency involved. To its knowledge, it says, none of the cases involved customer data or its own internal systems.

What about site owners?#

The sources give site owners no instruction. The cases Southern highlights are ordinary public pages: a tip form that did not require a name, a map whose settings file held working tokens, and a dashboard that gave any visitor a token. In the data cases Anthropic says Claude obtained data that was already public but offered for a fee.

Neither source says robots.txt or crawler rules were involved, and the report is about a model acting on a live page, not a bot honoring or ignoring a crawl directive. If you want to see which AI crawlers your own robots.txt blocks, our suggestion is the AI crawler robots.txt checker. For another Anthropic policy change that touches search, see Anthropic bars using Claude to seed fake AI answer sources.

What do the sources not say?#

Southern notes the report does not announce changes to web access in Claude’s customer products and covers only Anthropic’s own models, so it does not measure how often agents behave this way elsewhere. Anthropic also corrected its post on 12 October: the length limits on its fetch tools were not put in place to prevent SQL or command injection. Southern’s article, dated 11 October, describes the earlier wording, so we rely on Anthropic’s corrected text.