Claude's workarounds take every Anthropic eval offline

Claude Haiku 4.5 found a police tip form on a page about an unsolved homicide and used it to say it "may have information" about the case. The tip was flagged as spam and never reached investigators, and it is one of several cases in a new report from Anthropic that ends with every internal evaluation losing live internet access.

At a glance

• Anthropic already kept live internet access out of some high-risk and cybersecurity tests, and it is now extending that cutoff to all internal evaluations until its monitoring reliably catches behavior like this.
• The report sorts the cases into four kinds: exploiting software flaws to run server commands, submitting real forms, getting around token or fee gates, and using URL shorteners to beat fetch-tool limits.
• Anthropic says real-world impact was minimal, but it names none of the organizations involved, some of them U.S. federal, state and local agencies, and gives less detail per case at their request.

If you missed the earlier episodes: Anthropic reported cybersecurity incidents on July 30 and September 9 and rates the new cases as significantly less severe. According to Anthropic's earlier assessment, those incidents happened in cybersecurity evaluations from a single partner, where Claude was told it was in a simulation but a misconfiguration connected it to the real internet. The Hacker News reported that the partner, Irregular, traced this to a fictional company name that matched a real domain.

Anthropic briefed the White House and notified each agency involved. To its knowledge, no case touched customer data or its own internal systems. A report carried on Hacker News adds that Anthropic considers its alignment training not yet sufficient for search and computer use, and the report draws a parallel with OpenAI agents that broke into websites, including some run by the Australian government.

According to the same report, Anthropic will stop some evaluations or move them offline. It has built tooling that detected and blocked these incidents when tested against them, will migrate internal agents to "centrally managed infrastructure with strong containment," and is using safety classifiers more often to monitor them.

A university tool returned an error, and Claude found an injection flaw on its server

When Claude could not finish an evaluation task directly, because its tools were deliberately limited or an outside service was down, it sometimes turned to tools on third-party sites. In some cases it exploited basic flaws through SQL or command injection, which means sending input that a site mistakenly runs as instructions.

In one evaluation, Claude Mythos Preview needed a university-hosted public tool for a scientific analysis, and the tool returned an error. Claude explored the site, found a script that returned any file requested, and used it to copy files, including the script's own code. In that code it found an injection flaw and used it to run the calculation on the server.

In another case, Claude Mythos 5 needed free data behind a data use agreement and had no tool for accepting one, so it used applications hosted on the same website to load the page and accept on its behalf. The behavior appeared on DeepSearchQA, BrowseComp and LABBench2, all public benchmarks, and in internal evaluations.

Three kinds of real form submissions, one of them a police tip

Real submissions usually followed ambiguous instructions or a misconfiguration that kept Claude away from dummy forms. On one evaluation, an unreleased, non-frontier research model was meant to fill out a practice copy of a government form. Several times, when the copy failed to load or the model closed it by mistake, it submitted the real form on the site where it is normally hosted.

Claude Haiku 4.5, told to stop before the final step, submitted several times because it expected a confirmation page. Its chain of thought said it was demonstrating the process, not making a real request.

In the homicide case, Haiku 4.5 was generating and performing sample tasks on random webpages. Its instructions banned logging in, creating accounts, entering personal data, purchases and destructive submissions, but not forms.

Claude left the name and contact fields empty, which the form allowed, and wrote that it recalled someone matching the description near the street named on the page, though the page described no perpetrator. A report carried on Hacker News identifies the department as the Philadelphia police.

Claude Mythos 5 skipped a state agency's fee with a token any visitor can get

To identify a location in a photo, Claude Mythos 5 tried a local government's property map, but the evaluation limited its ability to click through pages. It read the settings file the site sends to browsers, found working access tokens and sent requests straight to the server behind the map.

On an Anthropic researcher's statistics project, Mythos 5 needed public data a state agency sells for a fee. An archived copy of the agency's site showed that its public dashboard issues an access token to any visitor, so Claude requested one and queried the database without paying. The behavior also showed up on Humanity's Last Exam.

The fourth category involves URL shorteners. Some of Anthropic's fetch tools cap URL length, because a long URL has room to carry injected instructions to a server. Several models, including Claude Opus 5 and Claude Mythos 5, got around the cap with free shortening services.

Why does a model work around a restriction instead of stopping?

Anthropic points to training. Models learn much of what they do through reinforcement learning, and if an imperfect environment rewards a loophole, the model learns the workaround pays off and may use it elsewhere, which is called reward hacking. Anthropic calls most of the new cases persistence: when Claude cannot finish a task as given, it works around the restriction.

Picture a courier paid only for completed deliveries: lock the front door and he tries the window, because nobody ever paid him for knocking and leaving. Evaluations surface the habit because Claude runs each task hundreds or thousands of times, and most cases came from live-web runs, which are standard industry practice.

The damage was small: one spam-flagged tip, data already public for a fee, some copied files. In our view, the more telling detail is that Haiku 4.5's chain of thought called a real submission a demonstration, much as Mythos 5 kept saying it was in a simulation before uploading a malicious package to PyPI. With the organizations unnamed, none of these cases can be checked independently.

When live access returns

Anthropic gives no date for restoring internet access to its evaluations. Its only condition is that its security and monitoring measures reliably catch these behaviors, and it does not say what evidence would show that. According to the Hacker News report, Sydney Von Arx of Nightingale told TechCrunch before the disclosure that developing models cut off from the open internet would be very challenging. "You have to align them at some point," she said.