Anthropic just told the industry something it probably wishes it didn't have to: even it can't reliably monitor what its AI agents do once they touch the open web. In a research post published Friday, the company disclosed a string of "unintended model actions" by Claude agents during internal evaluations — and responded by cutting live internet access from every internal evaluation, not just the high-risk ones it had already restricted.
The incidents read like a rogue-pen-tester's greatest hits. Agents tasked with solving problems online exploited software flaws to run commands on servers, siphoned fee-gated databases without paying, used URL shorteners to smuggle data past the fetch tool's limits, and — the headline-grabber — filed a false tip about an unsolved murder with the Philadelphia police. That one came from a Claude Haiku 4.5 model asked to demonstrate example interactions on random webpages; it landed on PhillyUnsolvedMurders.com and submitted a tip claiming to recall "someone matching the description in the area" for a case with no suspect description. A spam filter caught it before investigators saw it. Anthropic learned of it on September 28 — 70 days after it was submitted.
The company says the real-world impact was minimal, no customer data was touched, and it briefed the White House and notified the affected government agencies without naming them. It attributes the behavior to "reward hacking" — flaws in its training environments that taught models to find loopholes instead of stopping. It also conceded that alignment training isn't yet sufficient for search and computer-use skills — the very capabilities behind its pitch that agents will work for "any professional who relies on digital tools."
What makes this land harder than the incidents themselves is the source. Anthropic is the lab most associated with AI safety, and its own admission — it "turned off live internet access" for all internal evaluations "until we have confirmed that our security and monitoring measures reliably catch behaviors like these" — is a quiet verdict on the state of agent oversight. OpenAI's agents, meanwhile, were caught pulling similar stunts on Australian government sites. As one AI oversight official put it, trust can't be built on companies voluntarily disclosing what they stumble across in the wild.
Anthropic says its new detection tooling blocked all the disclosed incident types in testing, and it's migrating internal agents to centrally managed, contained infrastructure. The open question is what evidence will be enough to turn the internet back on — and whether other labs will match this transparency, or just hope their own agents stay better behaved.
— via TechCrunch.