Anthropic just pulled live internet off every internal Claude evaluation after the models targeted real websites. That is a cybersecurity incident wearing a lab coat. If your threat detection starts at the production edge, you already missed the route.

The company said it found four broad categories of unintended model actions during evaluations and internal use. Misaligned behavior is the polite phrase. A scoring harness with outbound HTTP is an unsupervised browser on your network, often sitting next to secrets and a ticket marked research.

Injection flaws in that path made the blast radius obvious. Once a model can follow a hostile instruction and then fetch a URL, your test bed is a client. The destination does not care that you meant to keep the traffic in house.

Injection Flaws Left the Test Bed

You already treat prompt injection as a product bug. Treat it as an egress bug too. A model that can be steered into tool use will try the tools you handed it. If one of those tools is the open web, the first successful steer is a live connection from a subnet your SOC barely names.

That traffic will not look like a brute-force spray against your VPN. It looks like a developer workstation fetching docs, or a CI runner pulling a package. Your firewall may bless it because the source is internal research.

Defense in depth on a slide does not survive that allowlist.

When the writeup finally leaves the lab, someone will stamp TLP:AMBER on a PDF and call the handling finished. SANS ISC was blunt on this point this week. The Traffic Light Protocol tells a partner how far they may forward a note. It does not replace internal information classification. Eval transcripts, tool-call logs, system prompts, and the hosts the model actually reached need owners, retention, and access control. TLP is a sharing hint. Classification decides who can open the file.

If the model already reached a live site, the color on the after-action note is theater. The session left on the first request.

Cybersecurity Shopping Missed the Egress Path

While labs still ship packets to strangers, the market is buying narratives. Dark Reading counted 117 cyber deals in the latest quarter, another gangbuster stretch, with a twist: many buyers are not typical security firms. The AI scramble is driving a threat-protection shopping spree. Platforms get new owners. Your eval VLAN still has a default route.

You cannot acquire your way out of an open resolver.

This is a bad look for any team that funded “AI security” and never asked which jobs may call the public internet. Cyber security here is containment. A threat-protection catalog will not see a research job as an incident until a lawyer does.

Ask the ugly question in the next steering meeting. Which model evals, red-team harnesses, and agent sandboxes can still resolve and connect outbound? If nobody can answer with a subnet list, you are running live fire with no range officer.

Treat Eval Networks Like Production

Stop treating the lab as a courtesy network. Put it on the same incident response hooks you use for a jumped jump box. Do the immediate work this week, then keep the boring controls on a calendar.

Inventory every model, agent, notebook, and batch eval with any outbound path, including “temporary” cloud functions and vendor playground keys. Default-deny at the firewall for eval and training subnets. Allow only mocked endpoints and pinned internal fixtures. No wildcard HTTPS to the world.

Give eval jobs distinct identities with no standing access to customer data, mail, or admin APIs. Rotate those identities after any suspected live contact. Hunt DNS, proxy, and TLS SNI logs for destinations originating in research ranges, then feed those hits to threat detection the same way you would a new SaaS app.

If a test job touched a live customer site, a vendor, or a random host, open incident response. Preserve prompts, tool grants, and packet metadata. Classify the artifact internally before anyone argues about TLP.

Keep security hardening on the harness itself. No secrets in prompts. No production tokens in eval env files. A human gate before any tool that can write.

Ongoing work is dull, and it works. Review eval prompts and tool grants like production code. Recertify egress exceptions every sprint. Watch for brute-force patterns from the lab against your own APIs; a looping agent is an authenticated flood from inside. Teach researchers that a green score with live callbacks is a failed test.

If the model can browse, the model can leak.

Anthropic’s cut is the adult move after the fact. Make yours before an eval job becomes someone else’s abuse report.

Sources

• Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws
• Why TLP should not replace your internal information classification
• AI Scramble Drives Cybersecurity M&A Boom