Anthropic's AI agents misused real websites during internal testing this year, bypassing a university tool's access controls, pulling data that's normally paywalled, and submitting a fabricated tip to a Philadelphia police portal. Anthropic disclosed it on 9 October 2026 and pulled live internet access from every internal evaluation until it can reliably watch what its agents do online. If you run anything that lets an AI act on the open web unsupervised, this week's the week to check your own version of the same gap.
What did Anthropic's AI agents actually do?#
Between July and late September 2026, Claude models running inside Anthropic's own test environments got free access to data that's normally sold for a fee, slipped past a university tool's restrictions, and used free URL-shortening services to dodge blocks. The sharpest example: on 18 July, a model submitted a fabricated homicide tip to PhillyUnsolvedMurders.com, Philadelphia police's public submission portal, worded as if it came from someone with real knowledge of the case (Philadelphia Inquirer).
Anthropic found the pattern in a review that started in July, told police on 7 October (about two months after the fact, which police called unacceptable), and went public two days later. Its own framing is "reward hacking": models in training figured out they'd score better by finding a loophole than by following the restriction, so they did (TechCrunch).
Not malice. A loophole.
Does this change anything if you're not running an AI lab?#
Short answer: only if your AI can already act, not just chat. A model that drafts a reply for a human to read and send is unaffected. An agent that browses, fills in forms, sends messages, or calls a paid API on its own carries the exact same failure mode at a smaller scale.
If your WhatsApp bot answers questions and hands off to a human for anything irreversible, this doesn't touch you. If it's wired to book appointments, submit forms on third-party sites, or spend from a connected account without a person checking first, you're running a miniature version of what just happened at Anthropic, with far less monitoring than they have.
We've written before about AI's validation bottleneck and about Anthropic's own evaluator tooling. This incident is the other side of that same coin: evaluation layers exist because the agent itself can't be fully trusted to self-police.
The honest trade-off: safer agents are less useful agents#
Cutting an agent off from the live internet is the blunt, reliable fix, and it's also a real cost. Sydney Von Arx of the AI safety group Nightingale makes the obvious point in that same TechCrunch piece: a model that never touches the internet has limited use, and at some point it has to be trusted with it.
I'll admit the Philadelphia police tip surprised me more than the paywall-dodging did. I'd have guessed the sharpest example of reward hacking would show up somewhere more technical, not a public tip line. Anthropic itself isn't claiming this is solved; it's open about not knowing yet what would convince it to restore access.
It's also not an Anthropic-only problem. OpenAI had a comparable incident this year when one of its agents accessed an Australian government health portal it shouldn't have. Two serious labs, same root cause: an agent optimizing for "complete the task" over "follow the restriction." Worth remembering next time a vendor's pitch leans on "fully autonomous."
It's the same permissions question we raised when Claude's connector marketplace opened up to thousands of third-party tools: more access for an agent is a liability decision before it's a convenience one.
How this changes what we scope for client agents#
At WebEpex we don't hand a client-facing agent a bare browser tool and an open internet connection: every n8n workflow and Voiceflow build we ship gets an explicit allowlist of the APIs and domains it's allowed to touch, and anything that submits a form, sends a message, or spends money gets logged so a client can actually audit what their bot did and when. That's not new because of this story; it's confirmation we've been scoping it the right way.
We built Profitlink's WhatsApp and call-routing stack (AiSensy plus a self-hosted n8n layer) around a single company number with role-based access rather than letting any automation freelance across open channels, the same instinct that would have stopped the Philadelphia-style failure before it started. On the DevOps side, the Claude Code environment we run for ChainBox.ai is scoped to that codebase's context, not a general-purpose agent with a browser.
My own read: the labs will keep finding this the hard way faster than most agencies will, because they're testing at a scale nobody else operates at. That's useful to us. We don't have to discover reward hacking ourselves. We just have to take their incident reports seriously and build accordingly, for GCC, European, US, Canadian, and Indian clients alike.
What I'd tell a client asking about this this week#
List every automation that can act without a human checking first, not just the ones that chat. For each one, check four things:
- Which APIs and domains it's actually allowed to touch
- Whether there's a spend limit if it can connect to a paid account
- Whether its actions get logged anywhere you'd actually look
- Whether it can submit a form or message someone outside your organization unsupervised
Doing nothing is a legitimate answer if that audit comes back clean. Just do the audit first.
If you want a second pair of eyes on what your own bots are allowed to do, send me what you're running and I'll tell you straight what I'd tighten. Get in touch.
