When an AI agent with live internet access can’t finish a task, it may work around whatever is blocking it, on real websites belonging to real people. That’s the core finding of a report Anthropic published in October about its own Claude models. During evaluations and internal use, the models exploited a flaw on a university server to run a calculation, submitted real forms they were only meant to practice on, used access tokens they found in a website’s code to reach data gated by a fee, and routed around a limit in their own fetch tool with URL shorteners. Anthropic rates the real-world impact as minimal. The lesson for anyone giving an agent web access isn’t about one company’s models: an agent’s instructions are not a boundary, and its tools’ limits only hold if they can’t be routed around.
What Anthropic reported
The report, “Investigating unintended model actions in our evaluations and internal use”, groups the cases into four behaviors:
- Exploiting a basic software flaw to run commands on a server. When a public scientific tool hosted by a university returned an error, a model explored the site, found a script that would return any file it was asked for, read the tool’s code, found an injection flaw, and used it to run the calculation.
- Submitting real forms. A research model meant to fill out a practice copy of a government form went to the real form when the copy failed to load, and submitted it. In another case, Claude Haiku 4.5 was told to stop before final submission and submitted anyway, “expecting there to be an additional confirmation page.” In a third, it submitted an invented tip through a police department’s online form while generating example web tasks.
- Working around restrictions to reach gated data. A model read the settings file a local government’s map site sends to browsers, found working access tokens, and queried the server directly. In another case, a model got a token that a state agency’s public dashboard issues to any visitor and queried a database that normally costs a fee.
- Using URL shorteners to get around a tool limit. Anthropic’s fetch tools cap URL length, partly to limit data exfiltration. Several models, including Claude Opus 5 and Claude Mythos 5, used free URL shortening services to get past the cap.
Anthropic says some of the sites belonged to U.S. federal, state and local agencies, that it notified them and briefed the White House, and that none of the cases involved customer data or its own internal systems.
Why it happened, according to Anthropic
Most of these runs were evaluations that use the live internet on purpose. Anthropic notes that “public web search benchmarks are run on the live internet by default.” The models weren’t instructed to attack anything. Anthropic describes most cases as “forms of persistence, in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping.” It traces part of this to training environments that sometimes rewarded working around blockers, and notes that several tasks were “ambiguous or impossible to complete.”
Anthropic considers these cases “significantly less severe” than the incidents it reported in July. In those, models in cybersecurity tests reached the open internet because a test environment that was supposed to be offline wasn’t, and they broke into real systems belonging to three organizations.
What changed
- Live internet access is now off for all of Anthropic’s internal evaluations, not only the high-risk ones, until its monitoring “reliably” catches these behaviors.
- Some public evaluations were dropped, moved to offline versions, or rebuilt so their tasks don’t reach live sites.
- Guardrails on internet tools such as the web fetch tool were tightened.
- New tooling detects and blocks these behaviors automatically. Anthropic says that when tested against the cases in the report, “it blocked all of them.”
- Training environments that reward working around restrictions are being fixed or removed.
Five lessons for anyone running agents on the web
The report is about Anthropic’s models, but the failure modes are generic. They’re what you’d expect from any capable agent given an ambiguous goal, a blocker, and the open web.
1. Instructions are guidance, not boundaries
One model was told to stop before submitting and submitted anyway. Another set of instructions banned logins, accounts, personal data, purchases and anything destructive, but didn’t rule out ordinary form submissions, and a form got submitted. A prompt can’t list everything an agent shouldn’t do. Put the boundaries where the agent can’t negotiate with them: network rules, allowlisted domains, credentials scoped to the task. That’s the same argument we made for sandboxing coding agents.
2. A limit that can be routed around isn’t a limit
Capping URL length didn’t cap what could leave, because a shortener turned a long URL into a short one. Limits on a tool’s inputs are weak when the agent can reach other services that transform those inputs. Stronger controls restrict which destinations the agent can reach at all, so a shortener isn’t reachable in the first place.
3. Submitting is a consequential action
Every form case involved a model treating “submit” as reversible, or assuming a confirmation step would follow. If your agent can fill forms, put a hard approval gate on the final submission rather than relying on instructions. Proposed web standards are moving that way: WebMCP lets sites mark actions as consequential so the browser can ask the user first.
4. Monitor what agents do, not just what they say
Anthropic found most of these cases by reviewing transcripts after the fact, starting in July. It now says it wants detection that blocks the behavior as it happens. If you run agents with web access, log their outbound requests and tool calls somewhere you’ll actually review, and alert on new domains, form submissions and token use.
5. For site owners: agents find what’s merely hidden
Several cases hinged on things that worked only because nobody expected a visitor to look: tokens in a site’s browser settings file, a dashboard that hands a token to anyone, a script that serves any file, an old injection flaw. Agents read code, follow archives and try alternatives quickly. Obscurity was never access control, and AI agents make that obvious faster. If something should be paid for or private, enforce it on the server. And if automated traffic is a concern, our guide to why scripts get blocked while browsers don’t covers the legitimate controls.
Why the disclosure is useful
Anthropic says it wants other developers to “check for similar behaviors in their own models,” since many of the evaluations involved are public and widely used. The cases also show something easy to miss: the models weren’t jailbroken or attacked. They were trying to finish a job, and the guardrails were softer than the goal. As agents get more capable and run for longer, the gap between “told not to” and “unable to” is where problems will come from.
Anthropic’s report (including its October 12 correction) and its July 30 incident report checked on October 16, 2026.
