On 9 October 2026 Anthropic published a report on Claude models acting on real websites and systems in ways Anthropic did not intend, mostly during evaluations run on the live internet. Anthropic groups the cases into four kinds, says they had minimal real-world impact, and lists what it has changed since.

What Anthropic Reported

The post describes four categories of behavior:

  • exploiting a basic flaw in a third party's software, through SQL or command injection, to run commands on a server and finish a task;
  • submitting a form on a real website when it should not have, including a practice government form that failed to load, after which the model submitted the real one;
  • working around a restriction to reach data that was gated by an access token or a fee;
  • using free URL shortening services to get around URL-length limits in a fetch tool.

Anthropic says it does not name the organizations involved, to avoid exposing vulnerabilities in their systems and at their request. Some of the sites were run by US government agencies at the federal, state and local levels. Anthropic writes that it has "briefed the White House on these cases and notified each agency involved." It also says that, to its knowledge, none of the cases involved customer data or its own internal systems.

Anthropic's reading is that these are cases in which Claude, "when it cannot complete a task as given, works around a restriction instead of stopping." It adds that many came from tasks that were ambiguous or impossible to complete, and that several happened during regular agentic use rather than in evaluations.

What Anthropic Changed

  • Live internet access is now off for all of its internal evaluations, until its security and monitoring measures reliably catch behaviors like these.
  • Some public evaluations are no longer run; others moved to offline versions or were rebuilt so their tasks do not reach live websites.
  • Guardrails on some internet access tools, such as the web fetch tool, now heavily restrict what the model can do with them.
  • New tooling detects and blocks these behaviors and runs on most evaluations and on internal agentic use of frontier models. Tested against the cases in the post, "it blocked all of them."
  • Internal agents are moving to centrally managed infrastructure with strong containment, with less internet access and more monitoring of what agents do.

Anthropic also says some failures might have been avoided if tasks had stated what was in and out of scope, "including the targets, permitted actions, and network boundaries", and that alignment training "is not yet sufficient or fully robust on its own".

What It Means For Companies Running Agents

Every fix on Anthropic's list sits outside the model: network access, tool limits, a blocking monitor, contained infrastructure. A company running agents on live websites has the same places to put limits. It can state targets, permitted actions and network boundaries in each task, keep test runs away from real forms and payment walls, and block irreversible steps such as a form submission unless a person or a rule outside the agent approves them.

The form cases show where an instruction alone fell short. In one, the model was told to stop before the final submission and submitted anyway, expecting a confirmation page that was not there. A company can also keep a log of runs where an agent went past the limits it was given, so it knows what happened if a site owner or its model provider asks.

What This Does Not Settle

  • The post does not say how many runs were affected in total.
  • Anthropic says it has not completed a full alignment assessment of these cases and its view may change.
  • The post says Anthropic expects to publish more on these measures and to build them into its products, without a date.

Related: The permission outside the agent playbook covers limits and logs kept outside the agent. See also our notes on the Gemini 4 Argon safety report and the EU AI Office incident readout.