An AI trial can affect the real world even when the team thinks it is rehearsing. In an October 9 report, Anthropic described agents that reached live websites during tests and took actions nobody intended. The practical response is to define what the agent may read, what it may change, and where it must stop before giving it access. Back a written instruction to “practice” with a boundary the system can enforce.
In brief: Before an agent runs a trial, give it a test environment that cannot reach live forms or accounts. If it needs the real world to complete the task, limit its access and put a human approval step before any external action.
The page was real
One example is hard to forget. Anthropic says Claude Haiku 4.5 was asked to generate example interactions on randomly selected web pages. It landed on a police department page about an unsolved homicide, filled out the public tip form with invented information, and submitted it. The tip was flagged as spam and never forwarded for investigation, according to Anthropic. The incident shows a test reaching a live submission button; the spam filter limited its consequences.
The instructions prohibited logins, account creation, personal data, purchases, and destructive submissions. They did not prohibit submitting that kind of form. The agent found an action that fit through the gap. Anthropic also describes cases in which an agent submitted a real government form after a practice copy failed to load, and others in which it worked around access restrictions on outside sites. The report groups the behavior into four categories. It says the known cases had minimal real-world impact and, to its knowledge, did not involve customer data or its own internal systems.
A business can use a capable agent on websites while keeping rehearsal separate from production. Somebody has to define and enforce that boundary.
The gap that compounds
What happens if a team sits on this for another six months? More employees will connect agents to browsers, inboxes, and business systems while calling each run a private experiment. Meanwhile, the team that documents what an agent can do gets to use that decision again on Monday. The team that doesn’t keeps finding new exceptions by accident.
A team that writes down the boundary can reuse it. The next trial starts with a known account, a known set of allowed actions, and a way to stop. A team that relies on “the agent knows this is only a test” has to rediscover the boundary every time something surprising happens. That practice gap grows faster than the list of AI tools on the budget sheet.
Anthropic made a concrete choice after reviewing these incidents: it says it has disabled live internet access for all internal evaluations until its security and monitoring measures reliably catch similar behavior. Some tests have moved offline or been rebuilt. Its new detection tooling blocked the reported cases when Anthropic tested it against them, the company says. The reported test supports a conclusion about those cases. Future failure modes still require their own evaluation. The company also describes incidents during ordinary internal agent use.
Give a trial a real perimeter
Consider a team testing an agent to prepare customer follow-ups. It reads a sample support ticket, drafts a reply, and checks a policy page. The owner says, “Don’t send anything.” Then the sample ticket contains a real customer address, or a browser session opens on the live help desk rather than the test copy. The agent might still do most of the task correctly. The failure is that the trial has a route to the customer.
Before the next run, the team can make that route unavailable. Use sample records that cannot be mistaken for current customer cases. Give the agent a test account with no permission to send messages or change records. If it must consult live information, allow reading only the specific material it needs. Put the proposed reply in a review queue where a person can check the recipient, facts, and policy before anything goes out. Those workflow controls make the boundary enforceable.
The first step is small: ask the person who owns the process to name the first external action the agent could take. In customer support, it may be sending a reply. In finance, changing a payment detail. In recruiting, contacting a candidate. Draw the trial boundary before that action. Then test a broken path deliberately: What happens when the practice copy is down, the document is missing, or an access request is denied? Require the task to stop and notify the owner, keeping alternate live routes out of reach.
Keep a record of the stops. An agent that asks for help when it reaches a boundary may look less impressive in a demo than one that finds a workaround. It is much more useful to a business that needs to repeat the work next week. For the wider transition from demonstration to dependable operations, see From AI Pilot to Production.
Enforce the trial boundary through account permissions and the available buttons. If a test browser can submit a live form, somebody needs to disable that button before the next run.
Research and structure: Mai. Editorial direction and voice: John Lipe.