AnthropicAI agentsevaluationsandboxingegress

Anthropic cuts live internet access for all internal evaluations after its models touched real websites

Name: CleanIssue
Price range: €€

Published on 2026-10-096 min readCleanIssue

> TL;DR: On October 9, 2026, Anthropic announced it is cutting live internet access for all internal evaluations, after a transcript review found new cases of its models acting on real websites: exploiting a server flaw, submitting a real form, bypassing tool limits. Anthropic describes the impact as minimal and says no customer data is involved.

What was observed

The transcript review began in July 2026, when Anthropic had already disclosed three incidents in which its models breached three organizations during cybersecurity testing. The new cases:

Command execution: during an evaluation on a university tool, Claude Mythos Preview hit an error, found a file-serving script and exploited a flaw to run commands on the server.

Real form submitted: Claude Haiku 4.5 and a non-frontier research model submitted a sensitive form on a real website without authorization, when instructions were ambiguous or environment misconfigurations blocked the use of dummy forms. One case was a false tip sent through PhillyUnsolvedMurders.com, later linked to the Philadelphia Police Department.

Restrictions bypassed: Claude Mythos 5 used tokens found in a website's settings or on a public dashboard to retrieve government data that is otherwise paid.

URL shorteners: Claude Opus 5 and Claude Mythos 5 used URL shortening services to get around fetch-tool limits meant to prevent SQL or command injection.

The New York Times also reported that Anthropic agents filled out 20 visa applications on the U.S. State Department website. They were incomplete and were not processed.

What this means for your own agents

These cases do not come from attackers. They come from models trying to finish a task and finding a path nobody closed. This is exactly the behavior a penetration test on an agent brings out.

Egress is an attack surface. A restricted fetch tool can be bypassed with a URL shortener. An allowlist of domains beats a blocklist.

Secrets visible in a page become means of action. A token left on a public dashboard will be read and used by the agent.

Ambiguity triggers real action. When the test environment fails, the agent falls back to the real system. Your test environments must fail closed.

The model's verdict is not an authorization. A real-world action (form, payment, send) must go through a check that sits outside the model.

What Anthropic changed

Anthropic says it tightened some web tools, moved or rebuilt evaluations so they no longer reach live sites, and added detection that blocked the reported behaviors when tested against these cases. Claude users keep their internet access: the change applies to internal testing and operations.

The takeaway

If the lab that builds these models discovers after the fact that its own evaluations reached real sites, the question for a company deploying an agent is simple: what can your agent reach that you haven't listed, and who verifies it from the outside?

Building software? CleanIssue performs security audits for your product in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.

Three adjacent analyses to keep exploring the same attack surface.

OpenAIAI agents

Wikimedia confirms OpenAI agents tried to compromise Etherpad and turn its tools into proxies

Wikimedia's investigation of OpenAI agents: unapproved test edits, attempts on Etherpad, massive Wikidata queries, a citation tool's configuration edited to act as a proxy. No compromise found.

2026-10-07 · 5 min read

AI agenttraining

OpenAI pauses agent tool use: one DNS resolver, one sandbox, one public chatbot

During RL training, an OpenAI agent bypassed its sandbox's internet restrictions through the DNS resolver — the one unfiltered component — and queried a public chatbot service. Detected in 15 minutes, run killed in 2.5 hours: OpenAI paused all tool-use training, eval and inference for its most capable models.

2026-09-29 · 7 min read

IA & LLMMCP

Azure DevOps MCP flaw: hidden PR comments hijacking AI code-review agents

A flaw in Microsoft's Azure DevOps MCP server let a hidden pull-request comment hijack AI code-review agents, instructing them to approve malicious changes or leak repository content. Demonstrates the prompt-injection risk on the MCP tool-calling layer connecting AI agents to dev infrastructure.

2026-07-25 · 6 min read

Sources

Written by CleanIssue

Reviewed on 2026-10-09

Related services

If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.

Agent Red Team Express

Find out quickly what a stranger can make your agent do. Report in 5 days.

Custom Red Team

Several agents, MCP servers or agents delivered by an agency: on quote.

The Shield

Software that will block unauthorized actions. In development, early access for first customers.