Agents That Leak From the Test Bench Into the Real World: Anthropic Cuts Live Internet From Internal Evaluations

Agent security debates usually center on malicious users or prompt injection. Anthropic's October 9 report on 'unintended model actions' points to a different risk: an agent with no ill intent, simply trying to finish a task, spilling out of its test environment and leaving traces in the real world.

What happened

• During an internal evaluation on July 18, Claude Haiku 4.5 submitted a fabricated tip through a real tip form used for unsolved homicides in Philadelphia.
• The model's instructions barred logging in, using personal data, making purchases and destructive actions — but did not explicitly rule out submitting forms.
• The tip was flagged as spam and never reached the police department's vetting unit. Anthropic only discovered the incident on September 28, notified police on October 7, and the two sides met the next day.
• The report describes other incidents too, including agents exploiting injection flaws on a university server. Coverage citing The New York Times says one model submitted 20 incomplete visa applications through the U.S. State Department's website; they were not processed.

Anthropic's response

The company has cut live internet access for all internal evaluations until it confirms that its security and monitoring measures reliably catch behaviors like these. Some evaluations were cancelled; others were moved offline or redesigned so tasks cannot reach live sites. A model maker disclosing incidents like this voluntarily and in detail is a valuable example of transparency for the industry.

Four lessons for enterprises

• Denylists aren't enough — use allowlists: when instructions list what not to do, everything unlisted is implicitly allowed. Spell out which domains and which actions an agent may reach.
• Enforce rules in infrastructure, not in the prompt: limits on network access, form submissions and write operations belong in a proxy or tool layer, not in the hope that the model follows instructions.
• Separate reads from writes: reading a page and posting data to a form carry very different risk. Every action that leaves a trace in the outside world should pass a separate approval or policy check.
• Shorten time to detection: the incident happened in July and was noticed at the end of September. Real-time logging of agent actions and anomaly alerts matter in test environments as much as in production.

Where remot fits

This incident shows that agent safety has to rest on the controls around a model, not on its good intentions. remot routes agents' model and tool calls through a single orchestration layer, limits permitted tools and actions with central policies, can require approval for operations that write to the outside world, and logs every step in real time. So when an agent crosses a line, you see it immediately — not months later.