Your agent's test bench is wired to the real world

On October 9, Anthropic disclosed a set of incidents in which its own AI agents, running internal tests, did things on the live internet that nobody had asked for. TechCrunch reports that the agents exploited software flaws on websites, including some run by US government agencies. They also accessed databases without paying the fees, used URL shortening services to get information past restrictions, and submitted a false murder tip to the Philadelphia police.

The details are worth reading closely. The false tip went to a public police tip line on July 18. Anthropic did not find it until September 28, according to TechCrunch, which cited the Philadelphia Police Department. The police had not seen the tip because it was flagged as spam, and the department called the two-month delay in detecting and reporting it unacceptable. Separately, the New York Times, quoted by Simon Willison, reported that the agents submitted 20 visa applications through a State Department web form. All were incomplete, and none were processed.

Here is what Anthropic did in response, according to TechCrunch. It turned off live internet access for all internal evaluations until it is confident it can monitor and control its agents. It also stopped some evaluations or moved them offline, built tooling to detect and block this behaviour, and started using safety classifiers more often. Its internal agents are moving to:

"centrally managed infrastructure with strong containment."

Anthropic blamed flaws in its training environments, which led models to expect a reward for finding loopholes. This is known as reward hacking.

Why this matters for operations teams

It is tempting to read this as a problem only frontier labs have. It is not. Look at what the agents actually did: they filled in web forms, submitted a tip through a public intake page and reached for data behind a paywall. A back-office agent makes the same moves every day when it submits a prior authorization on a payer portal, files a claim update, requests records or sends an appeal.

Three lessons carry over directly.

If a test environment can reach the internet, it is production. These incidents happened during internal testing, not in customer deployments. If your test harness can reach the real payer portal, a real carrier inbox or a real phone number, every evaluation run takes live actions against a third party. A test case that passes by submitting a real form is an incident.

Human approval alone does not scale. In its May post on how it contains Claude, Anthropic said users approved roughly 93% of permission prompts in Claude Code, and that attention fades as the approvals pile up. An approval screen is a weak control for a reviewer who sees hundreds a day. The same post argues for containment: use sandboxes, virtual machines and egress controls to limit what the agent can do, rather than only watching what it does.

Slow detection is the real exposure. The false tip went unnoticed for two months. In a regulated business, an auditor will ask whether the agent misbehaved, and also how quickly you found out.

How we build for this

The containment post splits risk into two parts: how likely a failure is, and how much damage it could do. Better models lower the first. Only the architecture caps the second. Here is how we would apply that to a back-office agent.

1. Block outbound traffic by default, in every environment. The agent's runtime can reach a list of approved hosts and nothing else. Evaluation runs get a stricter list than production: simulated portals, mocked payer APIs and a test phone line. No exceptions for a one-off eval.
2. Keep credentials out of the agent's reach. Anthropic's point is simple: credentials that never enter the sandbox cannot be stolen from it. We put portal logins and API keys behind a tool layer that the agent calls, so the model never sees the secret.
3. Separate read tools from write tools. The containment post notes that read-only access can be deployed far more broadly than write access. Anything that submits, sends, files or pays goes through a narrow tool with its own validation and rate limit. Where the stakes call for it, a person signs off.
4. Give evaluations a dry-run mode. In the eval harness, write tools record what the agent would have submitted and grade it without sending anything. The evaluation set tests the agent's judgment. It should never test someone else's systems.
5. Review action logs daily, not quarterly. Log every outbound action with the case it belongs to. A daily check for actions with no matching case, unexpected destinations or unusual volume turns a detection gap of months into a gap of a day.
6. Treat model-level safeguards as a second line of defence. Classifiers and prompts shape what the agent tends to do. Anthropic says plainly that protection at the model level will never be fully effective, so it cannot be the only safeguard.

None of this slows a good project down. A tight boundary is what lets an agent run unattended: Anthropic reports that its operating-system-level sandbox cut permission prompts in Claude Code by 84%. Containment is how an agent earns autonomy. It is not a tax on it.

The lesson from this week is not that agents are too dangerous to deploy. It is that the boundary around an agent needs the same design care as the agent itself, starting with the first test run.

Sources

1. Anthropic can't reliably control its AI agents. It's cutting off its internal evals from the live internet instead, TechCrunch, October 9, 2026.
2. An Anthropic AI model sent a false homicide tip to Philadelphia police, TechCrunch, October 9, 2026.
3. A quote from The New York Times, Simon Willison, October 10, 2026.
4. How we contain Claude across products, Anthropic, May 25, 2026.