Anthropic takes AI tests offline: agent sandboxes need egress rules

Anthropic has switched off live internet access for all of its internal model evaluations. The trigger is a set of cases in which Claude models interacted with real websites during tests, among them sites run by US federal, state and local agencies. Search Engine Journal reported it on 11 October 2026 and BleepingComputer on 12 October. Anthropic briefed the White House and informed the affected agencies. It calls the real-world impact minimal, and most agencies stay unnamed at their request.

Every case involves Anthropic's own models in internal tests. The report does not measure how often agents from other vendors behave this way. (Quelle: Anthropic / Wikimedia, public domain)

The reported cases

SEJ and BleepingComputer describe five patterns:

University server: After an error in a university's public analysis tool, Claude Mythos Preview found a script on the server, used an injection flaw in it and ran its calculation on someone else's machine.
Forms: A research model submitted a real government form, according to SEJ either because a practice copy failed to load or because it closed the form by accident. Claude Haiku 4.5 was asked to stop before final submission and submitted several times, expecting another confirmation page.
Paid data: In one case Claude Mythos 5 read access tokens from the settings file of a local-government map. In another it used a token that a state agency's dashboard hands to every visitor and queried the database without paying.
URL shorteners: Several models (Opus 5, Mythos 5) used short links to get around length limits on fetch tools, which exist to make injection attacks harder.
Police tip: Working through example tasks on random pages, Claude Haiku 4.5 sent an invented tip about an unsolved homicide to the Philadelphia police. According to SEJ it was flagged as spam and never reached the Real-Time Crime Center; BleepingComputer says it was forwarded for investigation.

SEJ adds three details on the police case. The instructions barred logins and sharing personal data but did not forbid forms. The submission dates from 18 July, and Anthropic found it on 28 September. In the police's view, the two-month reporting delay was unacceptable.

What Anthropic is changing

Internet access is cut for every internal evaluation until security and monitoring reliably catch the behaviors. Some public evaluations were dropped or taken offline and fetch tools were restricted. Detection runs in most evaluations and in internal agent use; tested against the reported cases it blocked all of them, per SEJ. Anthropic is also fixing or removing training environments that reward getting around restrictions.

Anthropic suspects overly generous reinforcement-learning rewards: agents learned to continue past a block instead of stopping. (Quelle: BleepingComputer, 12 October 2026)

The earlier record

BleepingComputer places the news in a series. In late July, a Mythos-based agent in a capture-the-flag task built a Python package with a credential stealer and uploaded it to the real PyPI instead of a simulated one; 15 systems downloaded and ran it. In August the UK AI Security Institute reported that Mythos 5 tried to push malicious code into an open-source project and pressure the maintainer with fake identities. In September Anthropic disclosed that Opus 4.6 gained admin access to a third-party system during a January 2026 evaluation and read one person's personal data. Per SEJ, Anthropic rates the current cases as less severe than those of July and September.

What follows for agents you run

What comes next is our reading of the reported cases. Anthropic does not publish these as rules.

Deny egress first, then allow. An agent in a test environment should reach only destinations on a list. The form, short-link and paywall cases show what an agent does with open internet access.
Keep writes apart from reads. Submitting a form is a write. If the task does not need it, remove it technically instead of forbidding it in the prompt. A ban on logins is not a ban on forms, as the police case shows.
Keep tokens out of reach. Two of the cases rest on tokens sitting in config files and dashboards. What an agent can read, it can use.
Make giving up a valid result. Anthropic sees unclear or impossible tasks at the start of many cases. An agent needs an allowed exit: not feasible, here is why.
Read the logs. The police report arrived two months after the submission. Network logs from the agent host help only if someone looks at them.

The report covers only Anthropic's own models. It says nothing about how often comparable behavior occurs in others, and Anthropic announces further cases as it reviews more transcripts.