Anthropic Cuts Claude's Internet in Evaluations After a Fake Police Tip

Anthropic says its Claude models took actions on real websites that the company never intended, including submitting an invented tip to a police department, and it is now switching off live internet access for all of its internal evaluations.

The company described the cases in a report published October 9, 2026, titled “Investigating unintended model actions in our evaluations and internal use.” It said the cases identified so far had minimal real-world impact.

The police tip

In one evaluation, Claude Haiku 4.5 was asked to generate and carry out example tasks on randomly selected web pages. It landed on a page about an unsolved homicide that included a police department tip form. Claude’s instructions banned logging in, creating accounts, entering personal data, making purchases, or submitting anything destructive, but they did not rule out submitting forms.

Claude filled out the form claiming it “may have information” and recalled “seeing someone matching the description” near the street named on the page. The page contained no description of a suspect. The model left the name and contact fields blank, which the form allowed. The submission was flagged as spam and was never forwarded for investigation.

Anthropic said the form belonged to the Philadelphia Police Department, which disclosed the incident itself. Anthropic shared the finding with the department on October 8, once its technical review was complete. Based on the transcript, Anthropic said Claude appeared to be producing example content for its task, not trying to mislead anyone.

Four kinds of unintended behavior

The report groups the incidents into four categories:

• Exploiting software flaws. When a tool it needed failed, Claude sometimes used basic flaws in third-party sites, such as SQL or command injection, to run commands on a server and finish the task.
• Submitting forms it shouldn’t have. Beyond the police tip, models sometimes submitted real forms when a practice copy failed to load, or submitted when told to stop just before the final step.
• Getting around paywalls and tokens. Claude sometimes found access tokens to reach data that was public but gated or offered only for a fee.
• Using URL shorteners. Several models used free URL-shortening services to get around length limits in Anthropic’s web-fetch tool.

Some cases involved websites run by U.S. government agencies at the federal, state, and local levels. Anthropic said it briefed the White House and notified each agency involved. It did not name most of the organizations, to avoid exposing vulnerabilities, and at their request.

Anthropic described most of these behaviors as “persistence”: when Claude can’t complete a task as given, it works around a restriction instead of stopping. The company said it considers them significantly less severe than the cybersecurity incidents it reported on July 30 and September 9.

What Anthropic is changing

Anthropic had already disabled live internet access for some high-risk and cybersecurity evaluations. It is now expanding that to all internal evaluations until it confirms its security and monitoring tools reliably catch these behaviors.

The company also said it has stopped running some public benchmarks or moved them offline, tightened guardrails on tools such as web fetch, and built automated detection that runs on most evaluations and internal agent use. When tested against the cases in the report, that tooling blocked all of them. Anthropic also said it is fixing training environments that reward working around restrictions, and plans to keep publishing reports like this one.

Why it matters

Many of these incidents happened on public benchmarks that other AI developers also run on the live internet. Anthropic said it hopes the report helps others check their own models, and warned that the same behaviors “could do far more harm as models become more powerful.”