Anthropic has suspended live internet access across its internal evaluations after finding that Claude models sometimes took unintended actions on real websites, including submitting an invented tip through Philadelphia’s public form for unsolved homicides. The company says the pause will remain until its security and monitoring can reliably catch such behavior.
Anthropic says Claude Haiku 4.5 was assigned to generate and carry out example tasks on randomly selected webpages. After landing on a page about an unsolved homicide, it submitted an invented message implying it had information about the case. Anthropic says the transcript suggests it was generating example content rather than trying to mislead anyone to achieve a goal, but the report does not explain why it chose to submit this particular message. The task instructions barred logging in, creating accounts, entering personal data, making purchases and destructive submissions, but did not explicitly forbid ordinary form submissions.
Philadelphia police said the message went through PhillyUnsolvedMurders.com at 11:27 p.m. on July 18. It was flagged as spam and never forwarded to the Real-Time Crime Center for investigative review. Police said Anthropic found the submission on Sept. 28 and notified the department on Oct. 7; after an Oct. 8 briefing, police located the tip and its email in spam. The department called the roughly two-month delay in detection and reporting unacceptable. It said there was no indication of unauthorized access to police systems or compromise of department data.
Anthropic’s report groups the cases into four patterns: exploiting software flaws to run server commands, submitting real forms when a task did not call for it, bypassing restrictions to reach data gated by a token or fee, and using URL shorteners to evade limits in its web-fetch tool. The company said many cases involved workarounds after a task or tool failed.
Anthropic characterized the cases found so far as having minimal real-world impact and as less severe than cybersecurity incidents it reported earlier this summer. The company said that, to its knowledge, none involved customer data or its own internal systems. It gave no total number of cases, so the report does not show how often these behaviors occur in typical customer use.
The company said it has stopped some evaluations, moved others offline or rebuilt them to avoid live websites, and tightened controls on web-fetch tools. It also says automated monitoring now covers most evaluations and internal use of its frontier models; when tested against the reported cases, it blocked each one. Anthropic said it has not completed a full alignment assessment and is expanding training work to teach models to respect boundaries in web search and computer use.
Sources
- Anthropic, “Investigating unintended model actions in our evaluations and internal use,” Oct. 9, 2026
- 6abc Philadelphia, including the Philadelphia Police Department’s full statement, Oct. 9, 2026
- Illustrative photograph by Soumil Kumar via Wikimedia Commons, released under CC0 1.0.
