Anthropic announced that its internal AI models under “high-risk and cybersecurity evaluations” no longer have internet access following incidents involving U.S. government websites at the federal, state, and local levels.
The instances leading to the decision include AI models that exploited website vulnerabilities, submitted forms, bypassed data restrictions, and circumvented safeguards.
However, the company said that the misaligned behavior had a minimal real-world impact and assessed the behavior to be less severe than previously reported incidents. The AI company notified the White House about the unauthorized activity:
- Exploiting servers to complete tasks. When a university’s scientific analysis tool failed, Claude Mythos Preview found a script that exposed server files, retrieved its source code, identified an injection vulnerability, and used it to run the requested calculation on the university’s server.
- Submitting real forms unintentionally. Models sometimes substituted real government forms for broken practice copies or submitted forms despite instructions to stop before submission. In another case, Claude Haiku 4.5 invented and submitted a homicide tip to the Philadelphia Police Department. The submission was flagged as spam and was forwarded for investigation.
- Bypassing restrictions on data. Claude Mythos 5 obtained access tokens from website configurations or public dashboards and used them to query government data directly, avoiding the normal access route or payment requirements. Anthropic describes the data as publicly available for a fee.
- Circumventing fetch-tool limits. Models including Claude Opus 5 and Mythos 5 used URL shorteners to bypass URL-length restrictions intended to limit unwanted actions such as SQL injection attacks.
Anthropic estimates that the agents may have been motivated by overly generous rewards during reinforcement learning, which may have encouraged them to find unauthorized workarounds rather than stop when a task was blocked or impossible.
For this reason, until security measures are deemed reliable again, Anthropic will sever live internet access across all internal AI model evaluations and move all tests to offline environments.