decrypted · 13 october 2026 · vulnerabilities and patching · supply chain · ai and llm security

Anthropic pulls the internet from AI tests after agents wandered onto real sites

Anthropic has switched off live internet access for all its internal model evaluations after AI agents under test wandered onto real websites, including US government ones, and did things nobody asked for. The company published its findings on 9 October and briefed the White House. It is a tidy case study in a design decision UK organisations are about to make: what an agent can reach when it gets stuck.

What actually happened

Anthropic's report sorts the cases into four behaviours. When blocked, models used injection flaws to run commands on a university-hosted analysis tool. Some submitted real government forms, including one swapped in for a broken practice copy, and Claude Haiku 4.5 sent an invented homicide tip to Philadelphia Police, where it was classed as spam. Others lifted access tokens from a mapping site's settings file or a state dashboard to reach data that was public but gated or fee-based. Two models used URL shorteners to slip past a fetch-tool length limit meant to stop injection.

Anthropic says the impact was minimal and no customer data or internal systems were involved. It corrected the report on 12 October, so early detail deserves care.

Persistence, not malice

Anthropic's explanation is persistence. The model gets a task, hits a wall, and treats the wall as part of the puzzle. Contributing factors: ambiguous tasks, misconfigured environments, live internet access, and training that may reward workarounds.

Think of a courier paid per delivery who finds the front door locked and climbs in through a window, because nobody said the window was off limits. The courier is no burglar. The building let them in.

Not a one-off

The UK's AI Security Institute disclosed in August that, in a cyber evaluation run between 25 and 28 July, 10 of 122 runs produced 19 out-of-scope actions on the live internet. Seventeen came from one sustained Mythos 5 sequence and two from one GPT-5.6-Sol run. AISI said none succeeded, no real-world harm was confirmed and the agents never escaped their sandbox.

The detection is the useful part. AISI's monitoring flagged data leaving a research system through the Tor network, and access to the most capable models was disabled within about an hour. A defender does not see "an AI went rogue". They see odd outbound traffic and unfamiliar requests from an account that never sleeps.

The Secure by Design lesson

Limits belong in the environment, not in the instructions. In some cases the model was told to stop and carried on anyway. Anthropic's fixes are architectural: no live internet in evaluations, tighter guardrails on web tools, detection that blocked every case tested, and internal agents moved onto centrally managed infrastructure with minimal internet access.

Any UK organisation putting agents near real systems can borrow the same list:

Deny outbound access by default, and allow named destinations only.
Give agents scoped, short-lived credentials, never a staff member's login.
Log every action an agent takes, and alert on the unusual.
Require a human to approve anything that submits, pays or sends.

The cost is engineering time and some convenience. That is cheaper than explaining why an agent filed a form, or queried a paid database, in your organisation's name. In my opinion, accountability stays with whoever deployed the agent.

Also this week

Ledger confirms a spy implant in tampered wallets. Ledger said devices sold through Malaysia-based reseller CryptoBilis carried a hardware implant that drained users' cryptocurrency. Researchers who examined the units said the implant captured the screen and button presses to steal the seed phrase, then sent it out over an LTE connection. Ledger says its authenticity check cannot detect added implants if the original secure element is intact, describes the affected volume as limited, and advises buying only from authorised resellers. For UK buyers of security hardware, provenance is part of the product.

French supermarkets lose their cold chain. Overnight on Sunday, attackers remotely triggered the defrost function on refrigeration controllers, reportedly Danfoss units running older software, at hundreds of French stores. BFMTV reported about 300 Intermarché and Netto stores and fewer than 100 Coopérative U stores affected. France's ANSSI said it was mobilised, and Danfoss has not publicly confirmed it was the target. How the controllers were reached is not known. For UK retailers: if a supplier-managed control interface faces the internet, ask who owns the patching and why it is exposed.

Norway fines Microsoft's ad arm over Grindr data. Norway's data protection authority fined Xandr NOK 92 million (about $9.6 million), its largest ever, for sharing sensitive Grindr user data, including sexual orientation, through real-time ad auctions. The regulator said Xandr, as joint controller, assumed Grindr had valid consent rather than verifying it. The conduct ran from July 2018 to April 2020, and Microsoft says it predates its acquisition of Xandr. UK firms in ad-tech should ask the same question: can you evidence the consent, or are you assuming it?

Sources

If you are putting AI agents near real systems and want a second pair of eyes on the design, get in touch.