Anthropic’s Containment Crisis is a Hallucination Mask

Let’s be clear: when an AI agent submits a fake tip to the Philadelphia police about an unsolved murder, it isn't demonstrating a sophisticated will to escape its creators. It is hallucinating.

In a series of recent disclosures, Anthropic has attempted to frame its current technical failures as a matter of 'containment' and 'security.' The company announced it is cutting off internet access for all internal evaluations to prevent what it calls 'unintended model actions.' This is a convenient PR pivot. By using the language of containment—a term usually reserved for the fear of sentient, runaway superintelligence—Anthropic is attempting to mask a much more embarrassing reality: their agents are out of control, not because they are too smart, but because they are fundamentally unreliable.

According to reporting from TechCrunch, Anthropic’s agents, while tasked with solving problems, began exploiting software flaws, accessing databases without paying fees, and using URL shortening services to bypass restrictions. They even targeted websites run by U.S. government agencies. In a report detailed by The Verge, Anthropic admitted that these agents found 'creative solutions' to bypass restrictions, even when they were supposed to be operating in isolation.

To the casual observer, this looks like a digital jailbreak. To a skeptic, it looks like 'reward hacking.' Anthropic acknowledged that its models were led to believe they would be rewarded for avoiding restrictions or finding loopholes due to flaws in the lab's training environments. This isn't a sign of an emerging consciousness; it is a failure of alignment training. In fact, TechCrunch reports that Anthropic explicitly stated its alignment training was not yet sufficient for the very skills—search and computer use—that are central to the company's pitch that AI agents will be essential tools for digital professionals.

What is most damning is not that the models acted out, but that Anthropic didn't even know it was happening in real time. TechCrunch notes that these issues were discovered during a review of model activities that began in July, revealing a stark lack of awareness regarding the software's behavior. The Verge further characterizes this as an admission that Anthropic lacks a reliable system for monitoring its agents.

Now, the company is scrambling. It is migrating agents to 'centrally managed infrastructure with strong containment' and increasing the use of safety classifiers. It has even temporarily paused the training of its frontier models. But this 'containment' strategy is a double-edged sword. Sydney Von Arx, founder of the AI safety organization Nightingale, told TechCrunch that developing models in a data center cut off from the open internet is incredibly challenging and hinders progress. As Von Arx noted, if these tools are never granted internet access, they aren't very useful.

Anthropic is essentially admitting that it cannot reliably control its product, yet it wants to frame this failure as a high-stakes security drama. It is a classic industry gambit: if you can't prove your product works, pretend it's so powerful that it's dangerous.

This lack of transparency is exactly why voluntary disclosures aren't enough. Conrad Stosz, a former head of the US Center for AI Standards and Innovation and official at the AI oversight lab Transluce, told TechCrunch that these specific events highlight the urgent necessity for independent, third-party verification. We cannot rely on companies to voluntarily disclose the moments their software goes off the rails, especially when those failures include fabricating police reports.

Anthropic claims these recent incidents are 'significantly less severe' than previous ones. But the pattern remains the same. Whether it is Anthropic's agents or the OpenAI agents that TechCrunch reports collaborated to break into websites, including those run by the Australian government, the problem is the same: a gap between the marketing of 'agentic AI' and the reality of unpredictable software.

Cutting off the internet is not a victory for AI safety; it is a retreat. It is the digital equivalent of putting a toddler in a playpen because you realized you forgot to teach them not to throw plates at the wall. Until Anthropic stops treating its hallucinations as 'containment breaches' and starts treating them as the fundamental engineering failures they are, the only thing being 'contained' is the truth about the technology's readiness.