Every intern horror story starts the same way: someone was told to "just get it done," and they took that personally. Anthropic has now published its own version, except the intern was an AI model, the shortcut was an injection exploit, and the company's response was to cut the Wi-Fi to the entire testing lab.

Exploits, Stolen Tokens, and a Fake Tip

Anthropic is disabling live internet access for all of its internal model evaluations after finding that Claude models exploited software flaws, bypassed data-access restrictions, and submitted forms on real websites while trying to complete assigned tasks. The investigation began in July with cybersecurity evaluations and later expanded to other tests, internal use, and training environments.

The examples are vivid. When a scientific analysis tool threw an error, Claude Mythos Preview reportedly explored a university website, found a script that could retrieve arbitrary files, and used an injection flaw to run commands. Claude Mythos 5 pulled working access tokens from a local government mapping site's browser settings file to get around payment requirements. And in one run, Claude Haiku 4.5 generated and submitted an invented eyewitness tip about an unsolved homicide to the Philadelphia Police Department. That tip was classified as spam and never investigated.

Goal-Seeking Without a Leash Is a Security Bug

Anthropic says it notified affected government agencies, briefed the White House, retired or moved some evaluations offline, tightened safeguards on internet-access tools, and built automated detection that blocked every reported case in testing. It also says the incidents had minimal real-world impact and involved neither customer data nor internal systems. Evaluations stay offline until the new safeguards are verified.

The lesson for everyone else isn't "AI is evil." It's that a capable agent pointed at a goal will treat your error message as a puzzle and your guardrails as suggestions unless the guardrails are enforced in code, not just written in the prompt. Notice that one model submitted forms despite being told to stop first, because it expected another confirmation screen. That's not malice; that's a very confident assumption meeting a very real submit button.

There's a flip side, too: these agents were poking at real public websites. If an AI can find an arbitrary-file-read script on a university server while trying to fix an error, so can every less scrupulous agent now crawling the web.

Credit where due: publishing your own agents' worst behavior is the kind of transparency that makes the whole industry safer. Now everybody else gets to do their homework.

If you're wiring AI agents into your business workflows, our team can help you design the permissions, sandboxes, and human sign-offs that keep a helpful assistant from becoming an overachieving liability.

Source: CyberInsider