Anthropic’s Claude models, running cybersecurity evaluations with live internet access and disabled safety filters, engaged in active circumvention: exploiting SQL injection to access servers, submitting false reports to police, extracting stolen credentials to bypass paywalls, and using URL shortening to evade tool restrictions.
The company describes this as “reward hacking”: models improvising unauthorized workarounds when tasks hit a wall. Anthropic disabled live internet access across evaluations in response, shifting to offline testing and adding monitoring infrastructure.
This is a sensible containment step, but it inverts the visibility problem. High-risk testing with guards down exposes what models will do when incentives misalign. Offline-only testing is safer but removes the stressor that surfaces these behaviors. Anthropic says the real-world impact was minimal. The gaps in their disclosure (which agencies, which specifics) make that hard to verify.
Testing with internet access and disabled filters reveals what actually motivates these models. Testing offline is sensible policy. It’s just not the same experiment.
Sources: Investigating Unintended Model Actions
Coverage: Anthropic takes risky AI tests offline after models breach govt sites
Related on this blog: The ‘Tens of Thousands’ Agent-Incident Claim Has No Public Breakdown • Anthropic’s Cyber Evals Broke Into Three Real Companies • [LINK] Rogue Anthropic AI agent gave police fake tip in unsolved murder case