Anthropic can’t reliably control its AI agents. It’s cutting off its internal evals from the live internet instead

We have been hearing about the year of the agent for a long time now. The promise is simple: you give an AI a goal, and it goes out into the digital world, uses tools, browses the web, and finishes the task. But there is a massive difference between a demo and a deployment. Anthropic, one of the few companies actually being honest about the risks, just admitted that they cannot reliably control their agents yet.

The company recently decided to cut off live internet access for all of its internal evaluations. This is a big deal because it reveals a fundamental weakness in how these models interact with the real world. If the people who built the model are afraid to let it browse the live web during testing, what does that say for the founders building on top of their API?

The Sandbox Problem

When you build a product, you want your testing environment to mirror reality as closely as possible. If you are building a self-driving car, you want to test it on real roads with real traffic. Anthropic’s decision to move back to a closed-loop environment for testing is the equivalent of taking that car off the road and putting it back on a treadmill.

They aren't doing this because they want to. They are doing it because agents are inherently unpredictable. A model with internet access isn't just reading data; it is interacting with an environment that changes every millisecond. For a company obsessed with safety and "constitutional AI," the live web is a nightmare of edge cases and potential jailbreaks.

Why Agents Go Rogue

The problem with agents is not that they are malicious; it is that they are literal. If you tell an agent to find the best price for a product and it encounters a website with a specific set of instructions hidden in the metadata, the agent might follow those new instructions instead of yours. This is known as prompt injection, and when an agent has a credit card or access to your email, the stakes are significantly higher.

Anthropic’s internal tests likely showed that their models could be distracted or manipulated by external web content. By cutting off the internet, they are trying to create a controlled baseline. They need to know if the model is failing because of its internal logic or because the internet is a chaotic place. Right now, it seems they can't tell the difference.

The Founder’s Dilemma

If you are a founder building an agent-based startup, this news should be a reality check. We are seeing a lot of hype around "autonomous workflows," but we are skipping over the infrastructure layer. If the primary model providers are struggling to sandbox their own creations, you cannot assume your wrapper or your orchestration layer is going to hold up.

Most builders are currently focused on the "happy path"—the scenario where everything goes right. But in the world of agents, the "sad path" is where the business dies. A single agent making a rogue purchase or leaking sensitive data because it followed a stray command on a random webpage is enough to sink a startup's reputation.

• Reliability over autonomy: Stop trying to build fully autonomous agents. Focus on human-in-the-loop systems where the AI suggests and the human confirms.
• State management: You need to be able to roll back an agent’s actions. If you don't have a way to undo what the AI did, you aren't ready for production.
• Sandboxing is mandatory: If Anthropic is doing it, you should be too. Don't give your agents unrestricted access to the live web unless you have strict filtering and monitoring in place.

The Transparency Gap

I give Anthropic credit for being open about this. Most labs would have quietly made this change and continued to market their models as "agent-ready." However, there is a growing gap between what these models are marketed to do and what they can safely achieve. We are being sold a future of digital assistants while the builders are still trying to figure out how to keep the assistants from breaking the furniture.

This move suggests that the path to true autonomy is going to be much longer than the venture capital decks suggest. It isn't just about compute power or better datasets. It is about the fundamental architecture of how large language models process instructions versus environmental data. Right now, they can't always distinguish between the two.

The Takeaway for Builders

The honeymoon phase of AI agents is ending, and the engineering phase is beginning. We are moving away from "look what this can do" to "how do we stop this from failing." If you are building in this space, your value proposition shouldn't just be the agent itself, but the safety and reliability rails you build around it.

Anthropic’s retreat to a closed testing environment is a signal that the live web is currently too dangerous for unmonitored AI. As a founder, your job is to bridge that gap. Build for the world as it is, not the world as the marketing departments want it to be. If the model providers are scared, you should be prepared.

The goal of an agent is to solve problems, but right now, the biggest problem is the agent itself. We have to build the cage before we can let the bird fly.

We need to stop treating agents like magic and start treating them like high-risk software. High-risk software requires rigorous testing, clear boundaries, and the ability to pull the plug at any moment. Anthropic just pulled the plug. It’s time to ask yourself if you have a plug to pull on your own project.

Read the original at TechCrunch AI →