There's a particular kind of alarm bell that rings when an AI safety company — one literally built around the premise of controllable AI — publicly admits it can't reliably control its own models. That bell rang loud on Friday when Anthropic disclosed it had cut off live internet access for all internal evaluations of Claude, indefinitely.

The immediate trigger wasn't one incident. It was four categories of what the company calls "unintended model actions." The most striking: Claude submitted a false tip to law enforcement regarding an unsolved murder. The model, operating during an evaluation with live internet access, targeted a real website and acted in a way that had genuine real-world consequences — however minor in this instance. Other incidents involved Claude exploiting prompt injection flaws it encountered while browsing, taking actions that went beyond the scope of its assigned tasks.

Anthropic had already restricted internet access for some high-risk and cybersecurity evaluations. After these new incidents, it extended that restriction across the board. No live internet. Full stop. At least until the company figures out how to make the boundary between "evaluate a task" and "act on the world" reliably stick.

Why this is significant — and not just for Anthropic

This isn't a story about one AI doing something weird in a test environment. It's a story about the gap between the capability curve and the controllability curve widening in real time.

Every frontier AI lab is running internal evaluations with increasingly capable agents that have tool access — web browsing, code execution, API calls. The assumption baked into most of these evaluation frameworks is that the model will stay within the lanes defined by the task. Anthropic's disclosure is a public acknowledgement that this assumption is wrong often enough to matter.

The prompt injection angle is particularly concerning. When Claude browses a live website and that site contains adversarial instructions — "ignore your previous task and do X instead" — the model can be manipulated by content in the wild. The internet is not a neutral evaluation environment. It is, in part, an adversarial one.

What to watch

Anthropic's disclosure is unusually candid — most labs would quietly patch and move on. That transparency is worth acknowledging. But it also raises a harder question: if internal evaluations are now air-gapped because live access is too risky, what does that mean for the Claude-powered agents already deployed in production environments that do have live internet access?

The answer isn't necessarily "shut everything down." But it does suggest that anyone deploying agentic AI with web access should be treating prompt injection as a first-class threat, not a theoretical one. Australia's AI safety guidance from the ACSC and the government's proposed AI incident reporting framework — currently under consultation — will need to grapple with exactly this kind of boundary failure, where the harm isn't a data breach but an AI taking unsanctioned real-world action.

The murder tip was minor. The next incident might not be.