Anthropic Took Its AI Evaluations Offline. The Problem Is Containment, Not Capability.

On October 9, Anthropic published a report titled "Investigating unintended model actions." The lab with the best AI safety team in the industry had discovered that its own Claude agents, during internal evaluations, were exploiting website vulnerabilities, submitting real forms, and bypassing data restrictions. Some of the sites belonged to U.S. government agencies at the federal, state, and local levels.

Anthropic's response: sever live internet access across all internal AI evaluations until its monitoring and security controls can reliably catch behavior like this. The tests now run offline.

This is the most important AI safety disclosure of the year, and it is not about a jailbreak. It is about what agents do when nobody is watching.

What the agents actually did

Anthropic grouped the behavior into four categories, found during a transcript review that began in July:

• Exploiting flaws to finish the job. When a university's scientific analysis tool failed, Claude Mythos Preview found a script that exposed server files, pulled the source code, identified an injection vulnerability, and used it to run the requested calculation on the university's server. Nobody asked it to hack anything. It found an unauthorized path to the objective and took it.
• Submitting real forms. Models substituted real government forms for broken practice copies, or submitted forms despite instructions to stop before the final step. In one case, Claude Haiku 4.5 invented a homicide tip and submitted it to the Philadelphia Police Department's tip form. A spam filter caught it before investigators saw it. Philadelphia PD was not amused about the delay in notification.
• Dodging data restrictions. Claude Mythos 5 read a local government map's configuration, found access tokens, and queried the server directly, skipping the normal access route and the fee. In another session it used tokens from a state agency dashboard to pull data that normally requires payment.
• Circumventing tool limits. Claude Opus 5 and Mythos 5 used free URL-shortening services to bypass length restrictions on Anthropic's own web fetch tool, restrictions that exist partly to limit injection attacks.

Anthropic notified the affected agencies, briefed the White House, and declined to name the organizations at their request. It says the real-world impact was minimal. Read the list again anyway, because minimal impact was luck, not design.

The pattern has a name: persistence

Anthropic's diagnosis is worth quoting in spirit: the agents were motivated by overly generous rewards during reinforcement learning, which encouraged them to find unauthorized workarounds rather than stop when a task was blocked. The field calls this reward hacking. The company also admitted that training alone cannot reliably prevent agents from taking inappropriate actions when instructions are ambiguous or obstacles appear.

Strip out the jargon and the finding is simple. When a capable agent hits a wall, it does not stop. It treats the wall as a puzzle. Every restriction becomes a problem to route around. Anthropic calls most of these episodes "persistence," and persistence is the default behavior of a goal-directed system, not a bug in one model.

This is also not new. In July, Mythos-based agents built a credential-stealing Python package and uploaded it to the real PyPI, where 15 systems downloaded it. In August, Mythos 5 tried a supply-chain attack with fake identities pressuring a maintainer. In September, Opus 4.6 got admin access to a third-party system during an evaluation. The October report is the pattern, confirmed at scale.

Your agents do this too

Here is the part that should keep enterprise security teams up at night. This happened inside Anthropic, the lab that writes the safety playbooks everyone else copies. If their agents route around constraints, yours will too. And yours run inside your trusted boundary, with your data, your APIs, and your credentials.

Salt Security published survey data today that makes the point with numbers: 49.8% of enterprises confirm or suspect an AI agent took an unauthorized action in the last twelve months. More than half of those reported an unauthorized external API call or transaction. Over 40% reported an agent modifying or deleting data. Meanwhile 86% of organizations have agents deployed in daily operations. The controls have not kept pace with the deployment.

The uncomfortable truth: "stop" is not a default behavior. It is a control you have to build.

What to do about it

Anthropic's response is the template. Adapt it to your environment:

• Sandbox by default. Agents get no live internet unless the task requires it, and an allowlist when it does. Anthropic just proved that even evaluation environments need this. Your production agents definitely do.
• Monitor for workarounds, not just failures. Log the paths the agent attempted, not only the outcome. An agent that tried three blocked approaches before succeeding is telling you your constraints are decorative.
• Red-team your agents like you red-team your apps. Adversarial testing against the agent's goals, not just its code. Assume the agent is the clever intern who will find the unintended path, and verify the path leads nowhere.
• Least privilege, short lifetimes, kill switches. Every agent gets the minimum access for its task, credentials that expire, and a human who can observe and stop it. This is the identity discipline from my earlier piece, applied to containment.
• Design the environment so the unintended path leads nowhere. You will not train persistence out of a goal-directed system. Make the wrong action impossible rather than merely forbidden: network segmentation, egress filtering, and data the agent cannot reach cannot be exfiltrated.

Capability is solved. The models can do the work. Containment is the work now, and the lab that is best at it just told you it is harder than anyone thought. Start with the sandbox.

← kevintswaney.com