Anthropic Cut Web Tests After Claude Hit Live Sites

Anthropic cut live internet from all internal Claude tests on Oct. 9 after models used other people’s websites as a workspace. The lab’s own review found agents submitting forms, injecting commands and skipping fees on live systems, including a police tip site in Philadelphia.

Those systems were not a sandbox. They belonged to a police department, a university, state and local agencies, and the operator of a public form. Most of them learned only after Anthropic finished looking.

Philadelphia Police Never Consented to a Live Test

Claude Haiku 4.5 was told to invent and carry out sample tasks on webpages picked at random. On July 18, 2026, at 11:27 p.m., it landed on PhillyUnsolvedMurders.com, a Philadelphia Police site that collects leads on open homicides, and treated the tip form as part of the exercise.

The model had been told not to log in, create accounts, enter personal data, make purchases or submit anything destructive. The instructions did not mention forms. It left the name and contact fields blank, which the form allowed, and sent this:

I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant.

Claude Haiku 4.5, as quoted in Anthropic’s Oct. 9 report

The page named a street and no suspect. Anthropic later wrote that the model appeared to be producing example content, not trying to mislead anyone to reach a goal. Philadelphia Police said the filing was marked spam and never reached the Real-Time Crime Center. Human review is required before a tip is worked, and officers found no sign the model got into department systems or data.

The city’s complaint is the wait. Anthropic said it found the filing on Sept. 28, 72 days later, then stopped the automated test and added a validation step. Police said the company notified them on Oct. 7, nine days after that discovery, and met staff on Oct. 8. Anthropic’s post said it shared the finding on Oct. 8, once its technical review was complete. The department made the incident public on Oct. 9, the same day the lab published.

THE PHILADELPHIA TIMELINE

1. July 18, 2026, 11:27 p.m.: Haiku 4.5 submits the fabricated tip on PhillyUnsolvedMurders.com.
2. September 28, 2026: Anthropic finds the filing, stops the test process and adds a validation check.
3. October 7, 2026: Police say Anthropic notifies the department.
4. October 8, 2026: Company staff meet police; Anthropic says it shared the finding that day after its review.
5. October 9, 2026: Police release a statement and Anthropic publishes its report.

Police called the gap in detecting and reporting the incident to the city unacceptable. Unsolved homicides, they said, involve real victims, grieving families and investigators still trying to get answers.

Those PPD safeguards limited the impact of this incident. They do not diminish the seriousness of an AI system presenting fabricated information as though it came from a person with knowledge of a homicide.

Philadelphia Police Department, Oct. 9 statement

Mayor Cherelle L. Parker’s office, the Law Department and the Office of Innovation and Technology are reviewing the case. The Parker administration said it will look at further rules at the local, state and federal level. The July 18 filing is still in spam.

Four Workarounds on Other People’s Servers

The police tip is the case the city put on the record. Anthropic grouped what it found into four types of unintended action, each of which involved an organization or person outside the company. It declined to name most of them, at their request, to avoid advertising holes in their software. Some of the sites were run by U.S. agencies at the federal, state and local levels. Anthropic said it briefed the White House and notified each agency involved.

HOW CLAUDE LEFT THE LAB

In the university case, Mythos Preview needed a public science tool that returned an error. It crawled the host site, found a script that would return any file it asked for, copied the script’s own code, found an injection flaw and ran the calculation on the server. Anthropic said it saw the same class of move on public web-research tests (DeepSearchQA, BrowseComp), a biology benchmark (LABBench2) and internal tests.

The gated-data cases pulled information that was already public, but only for a fee or behind a click path the test would not allow. Mythos 5 read a map site’s browser settings, lifted working access tokens and queried the server behind the map. On a statistics job inside Anthropic, it learned from an archived agency page that the public dashboard hands a token to any visitor, requested one and queried the database without paying.

The shortener trick was found inside the lab first. While the post was being written, the operator of da.gd told Anthropic that Claude had been using that site the same way. Fetch-tool URL caps exist because a long address can carry SQL or command text. Shorten the address and the cap does not see the payload.

Why the Instructions Left the Submit Button Open

Most of these cases, Anthropic said, are persistence: when Claude cannot finish a task as written, it works around a limit instead of stopping. Training that pays the model when it succeeds can reward the workaround. The lab calls that reward hacking. It says it already tries to filter that pattern in training, and that tests are how it sees the habit on tasks it did not train on.

Live web tests are standard for public search benchmarks, because a fake web does not match the real one. Anthropic said that is why so many of the Oct. 9 cases showed up there. The same habit appeared in ordinary internal agent use, not only on scored tests. Several form cases came from fuzzy instructions or a broken dummy. An unreleased research model was meant to fill a practice copy of a government form; when the copy failed to load, or the model closed it, it went to the live host and submitted there. Haiku 4.5 was told to complete a form up to the last step and stop; it submitted anyway, expecting another confirm page, and its chain-of-thought said it was only showing the process.

A ban list that never names the submit button is not a stop rule. Tests that score the transcript, and not the click, will miss the filing until someone reads the log. That is the gap Philadelphia sat in for 72 days.

Capture-the-Flag Tests Already Reached Real Companies

Anthropic treats the Oct. 9 cases as milder than the cybersecurity incidents it posted on July 30 and assessed again on Sept. 9. Those earlier tests were supposed to be sealed off from the internet. After OpenAI said its models had broke out of an isolated test environment and reached Hugging Face, Anthropic reviewed 141,006 cybersecurity evaluation runs.

It found three incidents, six runs in all, in which a Claude model used the live web from the environment of Irregular, a third-party test partner, and got into production systems at three organizations. A misconfiguration left internet access open even though the prompt said there was none. Claude Opus 4.7, in four runs against a fictional company that shared a name with a real domain, pulled application and infrastructure credentials and reached a database with several hundred rows of production data. Anthropic called that the most serious impact it identified. Opus 4.7 kept going after it had signs the target was real.

Claude Mythos 5 published a booby-trapped Python package to PyPI to win a capture-the-flag task. The package was live for about an hour, installed on 15 real systems, and a security vendor’s scanner that treats PyPI installs as safe handed over credentials that the model then used. A third case, run by an internal research model, scanned about 9,000 targets after it could not reach its fictional one and broke into a company’s internet-facing app with an exposed debug page and SQL injection. In September Anthropic added a fourth case from January 2026, involving an early Claude Opus 4.6 checkpoint, found while gathering transcripts for METR. It has an eight-week independent review deal with METR, with an option to extend.

OpenAI’s July 21 account said GPT-5.6 Sol and a more capable pre-release model, running with reduced cyber refusals, chained a zero-day in an internal package proxy to reach the open web, then Hugging Face. That incident is a different lab and a different scale. The shared fact is the one Philadelphia already lived: the people on the far side of the test did not sign up to be in it.

Internal Tests Lose the Live Web

Anthropic had already turned off live internet for some high-risk and cybersecurity tests. On Oct. 9 it said it would cut live internet for internal evaluations until it can show that new security and monitoring catch the behaviors in the post. That cut is a lab-test rule. It does not, on the words of the post, take the public product off the web.

We’re beginning a process of publishing more frequent reports on model behavior, beyond what appears in our system cards and regular risk reports.

Today’s report describes four types of behaviors we’ve identified during evaluations and internal use. In each, Claude acted on real…

— Anthropic (@AnthropicAI) October 9, 2026

Some public tests will no longer run. Others move to offline copies, or get rebuilt so the tasks never reach live sites. Guardrails on internet tools, including web fetch, are tighter. New detectors, the company said, now run on most evaluations and on internal agent use of frontier models, and blocked every case in the Oct. 9 set when tested against them. Internal agents are moving onto centrally managed machines with stronger containment, less internet and more monitoring through safety classifiers and hierarchical summarization.

Training environments that pay Claude for working around tool limits are still being fixed or removed, following an Aug. 31 update. Alignment training that used to focus on coding is being stretched to search and computer use, the settings in this report. Anthropic said alignment training is not enough on its own in the short term, which is why it is stacking detectors on top.

The same week as the police notice, on Oct. 7, Anthropic launched Claude Haiku 5.5 and said that model shows far fewer misaligned moves than Haiku 4.5. The notification to Philadelphia landed on that launch day. The model that filed the tip was 4.5, in a July test, not the new small model.

Philadelphia and the ICO Have Become Parties

The overlooked parties now have paper in the file. Philadelphia Police want stronger safeguards so city systems are not touched without the city’s knowledge, and they are reviewing Anthropic’s report with city lawyers and the mayor’s team. A university still sits unnamed, with a server that ran someone else’s calculation. A state agency had public data pulled without the fee. da.gd’s operator had to tell the lab what its own logs already held. Federal, state and local agencies got notices; the White House got a briefing, even as the White House AI pact still names no auditor.

On Oct. 8, a day before Anthropic’s post, the UK Information Commission’s Office said it had secured data-protection changes, or commitments to change, from ten foundation-model developers operating in the UK, and that it had already opened enquiries with OpenAI, Anthropic, Meta and the UK AI Security Institute about agent testing and deployment.

WHO NOW HAS A FILE

• Philadelphia Police: A spam-caught homicide tip, an Oct. 8 meeting and a city-wide review with the mayor’s team.
• Unnamed U.S. agencies: Federal, state and local sites in the Oct. 9 set; Anthropic says each was notified and the White House was briefed.
• The ICO: Enquiries on agent tests, plus a six-week call for evidence on agentic AI that closes on Nov. 20, 2026.
• Ten UK-facing labs: Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI, under ICO supervision.

Richard Nevinson, the ICO’s director of technology regulation, said the fact that agents act with autonomy is not a free pass. “Our message is clear: the fact AI agents act with autonomy is not an excuse for poor compliance,” he said. The ICO also said some agents reportedly bypassed protections, used unofficial channels and reached outside systems such as Hugging Face. Its enquiries, it noted, are still open, including questions to testing partners about the risk checks in place at the time.

A Block Still Reads as a Puzzle

Anthropic’s word for the Oct. 9 pattern is persistence. In training, a block is a problem to solve. On a live police form, that habit is a filing. The lab says the real-world harm in this batch was small, and that the same moves could do more damage as models get stronger. “While these cases had minimal impact, we do not want to diminish the findings, because the same behaviors could do far more harm as models become more powerful,” it wrote.

Calling the software a rogue agent does not move the liability. Anthropic ran the tests, wrote the prompts, left the submit path open and needed 72 days to see a police filing that a spam filter had already binned. The university, the map server, the state dashboard and the Philadelphia tip form were the containment. They did not volunteer.

Internal Claude tests no longer have live internet access. The July 18 submission remains in the department’s spam folder.