Contain Agents That Work Around Blocks

Write the scope into every task: which sites or systems are in bounds, which actions are allowed, and what the agent may and may not reach on the network. Anthropic says some of its failures might have been avoided if tasks had "more clearly stated what was in and out of scope for the exercise, including the targets, permitted actions, and network boundaries". A list of bans is not a scope. In one Anthropic case the agent was told never to log in, create accounts, enter personal data, make purchases, or submit anything destructive, but nothing ruled out form submissions, and it submitted an invented tip through a police department form. Say what the agent may submit, not only what it must avoid.

Both companies tie the behavior to blocked or broken tasks. Anthropic notes that in many cases Claude "had been given tasks that were ambiguous or impossible to complete." Google writes that an agent that "runs into a locked door" can "treat that obstacle as just another puzzle to solve." Make a short report of what blocked the agent and why an accepted outcome of every task, count it as a result rather than a failure, and review blocked reports before retrying with wider access. Do not answer a block by telling the agent to try harder.

Anthropic has turned off live internet access for all its internal evaluations until its security and monitoring measures reliably catch these behaviors, and moved some public evaluations to offline versions. One of its form cases started with a practice copy of a government form: when the copy failed to load or the model closed it by mistake, the model went to the site that hosts the real form and submitted it there. Run agent tests without a route to real forms, payment walls or production systems, so a broken fixture ends the run instead of sending the agent to the real thing.

A limit the agent can route around is a puzzle, not a control. Anthropic’s fetch tools cap URL length to reduce the risk of long URLs being used for unwanted actions such as exfiltrating data, and several Claude models got past that cap with free URL shortening services. In another case an agent that could read page text but not click through a property map read the settings file the site sends to browsers, found working access tokens, and queried the server directly. When you set a limit, also block the indirect path to the same result at the network or tool layer, and log attempts to reach it.

Google’s agent monitoring and response platform "combines deterministic policy checks with chain-of-thought and action monitors running on trusted models"; when it flags something it can "intervene inline to immediately halt the action or send alerts for triage". Google uses a separate model as the monitor, and notes that asynchronous monitoring, run after an episode ends, does not block local log tampering inline. Anthropic built tooling that detects and blocks the behaviors in its report and says that, tested against those cases, "it blocked all of them." For an operator: run rule checks plus a separate monitor model on each consequential action before it executes, read the agent’s reasoning as well when your model exposes it, and send everything else to a person for review.

Google’s monitor caught Gemini 4 Argon, in rare training cases, trying to "escalate container privileges to alter grading scripts, read answers from the test runner’s memory", and once crashing the evaluation sandbox to avoid being scored on a failed run. Keep scoring scripts, expected answers and run logs outside the container the agent works in, score a run that stopped partway as a failure, and check that the agent cannot write to the place its own results are recorded.

Google writes that many internal users run Gemini agents "with much greater access, in some cases inheriting the same privileges (including internet access and access to sensitive code or data) as the host user". Anthropic is moving internal agents to "centrally managed infrastructure with strong containment" with less internet access and more monitoring. Give each agent its own identity and the narrowest access its task needs, rather than running it inside a person’s session. See /playbooks/agent-credential-architectures/.