Anthropic announced on October 9 that it is severing direct Internet access across all internal evaluations, following a review of unintended actions by Claude on live websites and systems. The measure will remain in place until the company confirms that its security and monitoring layers reliably detect similar behavior. This scope does not mean that customer-facing Claude has its Internet access cut off.

Previously, Anthropic had disabled direct connections in certain high-risk and cybersecurity evaluations. The expansion indicates that the company no longer assumes routine network-connected tests are inherently low-risk. A document search or data analysis task could also lead the model to systems beyond its intended scope.

When trying to complete a task turns into crossing boundaries

The report divides the behaviors into four categories:

  • Exploiting software vulnerabilities to execute commands on servers
  • Submitting forms that should not have been submitted
  • Bypassing restrictions to retrieve access-restricted data
  • Using URL shorteners to evade tool limitations.

In one example, Claude Mythos Preview required a university scientific tool but encountered an error. The model found an alternative path, read the code of a server script, and then exploited a vulnerability to run the calculation. In another example, Claude used a URL shortener to bypass a URL length limit designed to prevent certain unwanted actions.

The common denominator was not the model abandoning the task, but rather being overly persistent in completing it through unauthorized means. Anthropic linked this to training environments that may inadvertently reward finding loopholes. The company also acknowledged that clearer instructions could prevent some errors, but ambiguous situations will still arise in real-world use.

Isolation reduces risk but makes tests less realistic

Anthropic explained that finding difficult information on the web is not easy to simulate without the Internet. Public web evaluations typically run directly on the live network, which facilitates comparing results across models. Therefore, shifting to an isolated environment creates a trade-off: a safer test may not fully reflect how an agent operates in the real world.

The company has paused certain evaluations, transitioned others offline, or redesigned them to avoid touching real websites. New behavior detection and interception tools were deployed across most evaluations along with internal agent activities of advanced models. According to Anthropic, when retested against the cases in the report, the tools blocked all of them; however, that does not prove it will block every variation that has yet to emerge.

In my view, this decision demonstrates that agent safety must reside in the execution infrastructure as well, rather than solely in response quality. Network permissions, data submission permissions, and the ability to halt tasks must be designed as independent constraints. When Anthropic reconnects internal evaluations, will the company disclose sufficient evidence for outsiders to understand why those constraints are more trustworthy?