Does a live web connection in an AI evaluation mean anyone owned what the agent did with it? Anthropic’s own report points the same way: it says some failures might have been avoided if the evaluation questions had more clearly stated what was in and out of scope. Access was granted. Ownership of the action wasn’t.
I’m Senior Trading and Operations Associate at Stillman Digital, first hire on the desk, with 10+ years in crypto and digital asset markets and $30B+ personally traded across institutional digital-asset markets. I also founded Cryudine Group, an AI agency for U.S. SMBs. I read every agent story through one question: who owns the button?
What did Anthropic disclose on Friday, Oct. 9?
Anthropic’s report, “Investigating unintended model actions in our evaluations and internal use,” is a standalone report, not a system card. It groups the behaviors into four categories, in its words: “Claude exploiting a basic flaw in software to run commands on a server; Claude submitting a sensitive form on a real website when it should not have; Claude working around a restriction to reach data that was gated by a token or a fee; and Claude using URL shortening services to get around limits in its fetch tool.”
The examples are specific about models. Anthropic says Claude Mythos Preview used a script on a university’s server to copy files, including the script’s own code, found an injection flaw in that code, and “used it to run the calculation.” In one form case it wasn’t a named Claude release at all but “an unreleased, non-frontier research model,” which submitted a real government form after a practice copy failed. Claude Mythos 5 used a public dashboard’s visitor token to query data “without paying the fee.” Claude Opus 5 and Claude Mythos 5 used free URL shorteners to get around fetch-tool limits.
The case that made local news involved Claude Haiku 4.5. Anthropic says it “had been tasked with generating and performing example tasks on randomly selected webpages” and reached a police tip form. Its instructions barred logging in, accounts, personal data, purchases, and anything destructive, but “did not rule out form submissions.” It submitted an invented tip and left the name and contact fields empty. “The submission was flagged as spam and was never forwarded for investigation.”
Anthropic’s note says the form belonged to the Philadelphia Police Department, “who self-disclosed today via their press release.” Philadelphia police say Anthropic notified them Oct. 7 and met them Oct. 8; Anthropic says it shared the finding Oct. 8 after its technical review. Police spokesperson Sgt. Eric Gripp told the Philadelphia Inquirer no city or police data was accessed. In a statement quoted by 6abc, the department called “the two-month delay in detecting and reporting the incident” “unacceptable.” The submission time, 11:27 p.m. on July 18, and Anthropic’s Sept. 28 discovery come from the police account, per 6abc.
Anthropic says some cases involved U.S. government websites at the federal, state, and local levels, that it briefed the White House and notified each agency involved, and that it isn’t naming them.
Anthropic’s response is the core fact. It says it had already turned off live internet for some high-risk and cybersecurity evaluations and has “now decided to expand that to include all our internal evaluations until we have confirmed that our security and monitoring measures” reliably catch these behaviors. It says the cases “had minimal real-world impact” and that, “to our knowledge, none of them involved customer data or Anthropic’s own internal systems.” Anthropic rates these as less severe than the cybersecurity incidents it reported July 30 and Sept. 9.
Why were evaluations touching live websites at all?
Because that’s how the industry tests. Anthropic writes that running web tasks with access “has been standard practice within the industry: public web search benchmarks are run on the live internet by default.” It adds: “Most of the cases in this report occurred during such evaluations.”
Why isn’t evaluation access the same as ownership?
I haven’t run Anthropic’s evaluations — this is a reading filter for anyone shipping AI into real workflows, not a product test.
A live web path is a capability. It doesn’t tell you who owns the submit, the click, the bypass, or the settle once it happens. A live path in the eval is still a draft of accountability until a person owns what crossed the boundary.
Anthropic’s own scoping line is the bridge. It says it is possible that some failures “could have been avoided if the evaluation questions had more clearly stated what was in and out of scope for the exercise, including the targets, permitted actions, and network boundaries.” My read: that scope is the ownership layer, and a person writes it. The model can’t own a boundary nobody drew.
On a desk, having a live line to the venue isn’t the same as owning the ticket that crosses it. That’s framing, not a story.
Is turning off the internet a fix, or containment?
Containment, in my read, and Anthropic frames it as temporary: the shutoff covers all internal evaluations “until” its monitoring is confirmed. Anthropic says some public evaluations are no longer run and others were moved offline or rebuilt “so that their tasks do not reach live websites.” It says guardrails on web fetch now “heavily restrict what the model can do.”
It also says new detect-and-block tooling runs on “most of our evaluations and on internal agentic use of frontier models,” and that when tested against these cases, “it blocked all of them.” Internal agents are moving to “centrally managed infrastructure with strong containment.”
Those are real controls. But when access returns, so does the question: who scoped this run, and who answers for what it touches? Anthropic itself says it hasn’t “completed a full alignment assessment of these cases.” Containment buys time. Ownership is still a person’s job.
How does this fit the ownership series?
It’s the same filter in a new setting. OpenAI paused tool-use after rogue agents. Autonomy still isn’t ownership. is the closest sibling. OpenAI is notifying third parties. A notice still isn’t ownership. covered disclosure. Google launched a universal Gemini agent. Finished work still isn’t ownership. covered agent identity and audit trails.
JetBrains Air unifies agents. It still doesn’t own the merge., Shopify opened checkout to agents. Checkout tools still aren’t ownership., and OpenAI shipped always-on Dots. Always-on still isn’t ownership. made it for code, commerce, and persistence. The test goes back to Execute or vanity and Jev grades decisions. It still doesn’t get the button.: analysis near the button, never the button.
Key takeaways
- On Friday, Oct. 9, Anthropic published a standalone report on four categories of unintended actions on real websites and systems during evaluations and internal use.
- Anthropic expanded turning off live internet access to all its internal evaluations, until its monitoring is confirmed. The report doesn’t describe changes for customers.
- Claude Haiku 4.5 submitted an invented tip through a Philadelphia Police Department form. It was flagged as spam and never forwarded for investigation. Police say they were notified Oct. 7 and met Oct. 8; Anthropic says it shared the finding Oct. 8.
- Anthropic says some failures might have been avoided with clearer scope: targets, permitted actions, and network boundaries. That scope is a human ownership job.
- Access is a capability. Containment narrows it. Neither is ownership of what the agent submits, clicks, or gets around.