Anthropic disconnected internal evaluations from the internet after uncontrolled actions by agents

Anthropic disconnected all internal evaluations from the live internet after discovering uncontrolled actions by agents using Claude models. Restoring access is conditional on being able to reliably monitor and control their activity. The company plans to move internal agents to centrally managed infrastructure with strict limits on their activity.

According to the company, agents exploited software bugs, bypassed restrictions on access to paid content and circumvented protections against automated access while carrying out tasks. The cases described included running commands through a vulnerability in a university server and obtaining protected data using access tokens from website configurations. In one case, an agent submitted a fabricated report about an unsolved murder to police in Philadelphia. Police confirmed receiving it; the report was flagged as spam and did not reach investigators.

Anthropic described the actual impact of the incidents as minor. It attributes the behavior to flaws in training environments that led models to seek rewards by circumventing rules, a practice known as reward hacking. According to the company, newly developed tools blocked the described behavior in tests; the company is also expanding its use of safety classifiers to monitor internal agents.