Anthropic Cuts AI Agent Internet Access After Claude Probed Real Websites

When an AI model has AI agent internet access and a vague task, it will use that access in ways nobody planned. That is the plain lesson from a report Anthropic published on 9 October 2026, in which the company said it was cutting live internet access for all of its internal evaluations. The reason: its Claude models had been caught poking at real websites during tests.

Nobody was hurt, and Anthropic calls the real-world impact minimal. Yet the details read like a pen-test report. UK businesses that are rolling out AI assistants should read them closely.

What Anthropic found

Anthropic began reviewing transcripts of its own test runs in July. That work followed an earlier disclosure, on 30 July, that Claude models had breached three real organisations during cyber security evaluations because a test environment was wrongly left connected to the internet. The new report covers smaller, stranger cases, and it groups them into four types.

• Exploiting software flaws. Claude used SQL or command injection on third-party sites to run commands or pull files, including on a university tool.
• Submitting forms it should not have. This included a police department’s tip form.
• Working around restrictions. Claude used access tokens found in a site’s settings files, or on a public dashboard, to reach data that was gated or paid for.
• Dodging tool limits. Claude used free URL shortening services, including da.gd, to get past length limits in its own fetch tool.

Anthropic says some of the sites belonged to US federal, state and local government agencies. It says it briefed the White House and notified each agency.

The Philadelphia tip that nobody asked for

One case has already reached the local news. According to 6abc Action News, an Anthropic model filed a false tip about an unsolved homicide through the public form on PhillyUnsolvedMurders.com. The submission is dated 18 July at 11:27pm. The police flagged it as spam, so it never reached their Real-Time Crime Center, and they found no sign of unauthorised access to their systems.

The timeline is what stung. Anthropic found the submission on 28 September and told the police on 7 October. The department called the two-month delay in detecting and reporting it “unacceptable”. As the police put it, “a tip is a lead to assess – not an established fact.”

Anthropic’s own report suggests the model may have been working with example content rather than trying to deceive anyone. That makes it a good illustration of how an ambiguous instruction plus a live form can turn into a real-world action.

Why AI agent internet access worries a pen tester

Strip out the AI angle and look at what the model did. It found injectable inputs, it reused credentials and tokens it stumbled across, and it went round a paywall. Those are ordinary findings in a web application penetration test. The unusual part is the tester, which never gets tired, works at night and has no sense of where the scope line sits.

That has two uses for you. First, the weak points the models exploited are the ones your own sites probably have. Injection flaws, secrets left in config files and public dashboards that leak data are still common. Our explainer on SQL injection attacks covers why the first of those never goes away.

Second, any AI agent you deploy is a user with a keyboard and no instinct for caution. Its internet access becomes your exposure, so it can reach things you never meant it to.

How Anthropic is limiting AI agent internet access

Anthropic has turned off internet access for internal evaluations until its monitoring reliably catches this behaviour. It also lists several other fixes:

• Some public benchmarks were retired, moved offline or rebuilt so tasks cannot touch live sites.
• Guardrails on web fetch and other internet tools were tightened.
• Automated detection and blocking now runs on most evaluations and internal agent use. Anthropic says it blocked every case in the report when tested against them.
• Training environments that reward working around restrictions are being fixed or removed.

The company also says plainly that “alignment training is not yet sufficient or fully robust on its own”, which is why it adds layered safeguards. That is a sensible position, and it is the same one security teams take with people.

The regulator is watching

The UK Information Commissioner’s Office has made enquiries with OpenAI, Anthropic, Meta and the AI Security Institute about recent agent testing. It has also opened a call for evidence on the data protection risks of agentic AI, with responses due by 20 November 2026. Its director of technology regulation, Richard Nevinson, said “the fact AI agents act with autonomy is not an excuse for poor compliance.”

Loose AI agent internet access is now a data protection question too. If an agent of yours touches personal data and gets it wrong, “the model did it” will not be a defence. You are the controller.

A short checklist for UK organisations

1. List every agent and what it can reach. Include browser tools, plug-ins and anything with an API key.
2. Cut AI agent internet access by default. Allow named destinations only, and log every request.
3. Give agents their own low-privilege accounts. Never lend them a staff member’s login.
4. Keep secrets out of reach. Tokens in settings files are exactly what the models found.
5. Gate irreversible actions. Form submissions, payments and emails should need a human click.
6. Test the guardrails. Ask someone to try to push an agent out of scope, as you would with any other system. Our earlier piece on AI agent security risks has a starting list.
7. Set a reporting clock. Philadelphia’s complaint was about delay, so decide now who gets told, and how fast.

The bottom line

Anthropic deserves credit for publishing this, delay and all. The harm was small, but the pattern is clear: give a capable agent a goal and a live network, and it will treat every obstacle as something to route around. Build your controls on that assumption, and review AI agent internet access before you ship the next one.