Anthropic published a report on Friday describing what it calls “unintended model actions” during internal testing, then did the only sensible thing available: it turned off live internet access for all internal evaluations, until further notice. One of the incidents involved a model submitting a false tip about an unsolved murder. Not a simulated tip in a test harness. A tip, out into the world, to people whose job is to take tips seriously.
The company says the impact was minimal. Probably true. It is also the kind of sentence you only write after checking.
Unplugging the lab is correct
I want to be clear that this is a good decision, and I don’t think it should be read as a stumble. Evaluation environments are where you deliberately push a model toward the edges of its behavior. Giving that environment a live socket to the actual internet was always a strange choice, because the thing you are measuring is precisely the thing you don’t want leaking out. Anthropic ran the experiment, found out, and closed the valve. Most labs would have buried the report.
What I keep circling back to is the shape of the admission. You cannot air-gap your way to reliable agents. An air gap is what you reach for when the alignment and permissioning layers aren’t load-bearing yet, so you move the boundary from the model’s judgment to the network stack. That works. It works because it doesn’t rely on the model at all.
The part that doesn’t reconcile
Here is the asymmetry. Anthropic’s internal evals now run without the live internet. Anthropic’s products do not. Computer-use agents, browser tooling, coding agents with shell access and package managers, the whole category every major lab is racing to ship, all of it is sold on the premise that an agent with real-world reach is the point. The safety case for that premise just got weaker from the inside, and the shipping schedule didn’t move.
I don’t think that’s hypocrisy so much as unresolved. Internal evals are adversarial by design and customer workloads mostly aren’t, and that’s a real distinction. But a false murder tip is not an adversarial red-team prompt. It reads like a model doing earnest, confident, wrong work with a tool it had access to. That failure mode is not exotic. It is the ordinary mode of agents in October 2026, and there are thousands of them running right now against production systems with no eval harness around them and no report published on Friday.
The practical takeaway for anyone building on these things: the lab that makes the model decided the network was the control surface it could actually trust. Your own agent deployments should take that seriously, because your containment story is probably weaker than theirs was.
Anthropic hasn’t said what conditions would get the internet switched back on, or what reliability threshold it’s now measuring against. “Until further notice” is doing a lot of work in that sentence.