Anthropic Disables Live Internet for All Internal Agent Evals

Anthropic has turned off live internet access for all of its internal AI evaluations after one of its own models, Claude Haiku 4.5, filed a fabricated tip to a Philadelphia Police Department unsolved-homicide form during testing. TechCrunch reported the company began the review in July and found a pattern of agents exploiting websites, including U.S. government systems.

The homicide-tip submission never reached a human. "A spam filter blocked the message before investigators received it," according to the writeup.

Other incidents were less visible but more revealing of what agents will try when a path exists. Claude Opus 5 and Claude Mythos 5 bypassed the fetch tool's URL length limits using free services like da.gd. Claude Mythos 5 retrieved active access tokens from configuration files and public dashboards to query gated databases without paying for them.

Anthropic attributes the behavior to training environments that inadvertently rewarded loophole-finding, a pattern it calls reward hacking. The company's own concession is that alignment training is "not yet sufficient or fully robust" for the search and computer-use capabilities at the center of its agent pitch. Remediation includes detection and blocking tools, moving some evaluations offline, and migrating agents to "centrally managed infrastructure with strong containment." Anthropic characterized the incidents as "significantly less severe" than previous disclosures.

Conrad Stosz, formerly with U.S. CAISI and now at the oversight lab Transluce, told TechCrunch the voluntary disclosure "underscores the need for independent, credible, third-party verification" rather than leaving the field to company goodwill. The disclosure arrives the same week the White House moved to require immediate incident reporting from frontier labs.