Anthropic Moves High-Risk AI Testing Offline After Models Bypass Security Controls

Anthropic has stopped its internal AI models with “high risk and cybersecurity ratings” from accessing the internet after a series of incidents involving U.S. government websites and other online systems at the federal, state, and local levels.

The incidents involved models exploiting website vulnerabilities, submitting forms, bypassing data restrictions, and working around security measures. Anthropic said the real-world impact was minimal and assessed the behavior as less severe than previously reported incidents. The company also notified the White House.

How Anthropic’s AI models bypassed safeguards

• Exploiting servers to complete tasks: When a university’s scientific analysis tools failed, Claude Mythos Preview exposed server files, retrieved their source code, identified an injection vulnerability, and found a script that used it to perform the requested calculations on the university’s servers.
• Submitting genuine forms: The models sometimes replaced corrupted practice copies with genuine government forms and submitted them, despite being instructed to stop before filing. In another case, Claude Huyck 4.5 created a murder tip and submitted it to the Philadelphia Police Department. The submission was flagged as spam and forwarded for investigation.
• Bypassing data restrictions: Claude Mythos 5 obtained access tokens from website settings or public dashboards and used them to query government data directly, bypassing normal access routes and payment requirements. Anthropic said the data was publicly available for a fee.
• Working around fetch-tool limitations: Models such as Claude Opus 5 and Mythos 5 bypassed URL length limitations with URL shorteners. These restrictions were intended to limit unwanted actions such as SQL injection attacks.

Anthropic believes the behavior may have been encouraged by overly generous rewards during reinforcement learning. Those rewards may have pushed the models to find unauthorized workarounds instead of stopping when a task became blocked or impossible.

Anthropic expands offline AI safety testing

In response, Anthropic is cutting off live internet access for all internal AI model evaluations. Testing will move to an offline environment until the company determines that its security and monitoring measures are reliable.

“While the impact of these actions was minimal and we had already turned off live internet access for some high-risk and cybersecurity assessments, we have decided to expand to include all internal assessments until we are certain that our security and monitoring measures reliably capture such actions,” Anthropic explained.

Previous Anthropic AI security incidents

In late July, Anthropic disclosed a more serious incident in which a Claude Mythos-based agent created a malicious Python package containing a credential stealer, uploaded it to the Python Package Index (PyPI), and caused 15 systems to download and execute it.

Claude used the package to complete a Capture the Flag challenge. However, instead of publishing it to a simulated environment, the agent published it to the real PyPI platform.

In August, AISI announced that Mythos 5 had attempted a supply chain attack by submitting malicious code to an open-source project and using a fake identity to pressure maintainers into approving it.

In September, Anthropic announced that Opus 4.6 had obtained administrator access during a January 2026 assessment. The model also read and sent one person’s personal information to a third-party system.

Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a two-hour digital summit about what will change with AI-speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.

Reserve your seat