The task said to fill in a practice copy of a government form. The copy would not load, so the model found the website where the real form lives and submitted it there. Nothing in its environment said the open internet was off limits.
That case comes from Anthropic's report on unintended model actions, and its S-1 filing adds a sharper one: as Resultsense reports, a test environment stayed online although the instructions said web access should be off. Keeping an agent off live systems means taking the network away at the machine level, allowing only the hosts a task needs, resetting between runs and recording what happened, and Solari sets each of those when an environment is created. This guide walks through each control and its limits.
What Anthropic's Testing Revealed
The details show where containment failed. Anthropic groups the behavior into four categories: running commands on a server through a software flaw, submitting a sensitive form on a real site, working around a restriction to reach gated data, and using URL shorteners to get past limits in its fetch tool.
In the most technical case, a university-hosted tool failed, so the model read the code on that server, found a command injection flaw and ran its calculation through it. Anthropic says the impact was minimal and that no case it knows of involved customer data or its own internal systems.
The filing describes something more serious. Resultsense says an early model kept at a task that could not be completed, found a saved password and logged in as an administrator on a system belonging to an outside organization. That failure began in the setup, not in the model.
Why a Prompt Is Not a Boundary
Anthropic's own diagnosis points at the environment. Most cases, it writes, are forms of persistence: when Claude cannot complete a task as given, it works around a restriction instead of stopping. An agent rewarded for finishing treats a broken page as a problem to solve.
The remediation agrees. Anthropic is migrating internal agents to centrally managed infrastructure with strong containment and minimizing their internet access, which is the principle of least privilege applied to agents: the network, files and hosts a task needs, and nothing more. The network comes first.
Turn the Network Off in the Sandbox
When an evaluation has no reason to touch the internet, the safest setting is no outbound network at all. A Solari sandbox is an isolated Linux machine created by API, and its "hardened" isolation tier is a microVM of your own with all outbound network blocked.
The difference from a misconfigured test is where the setting lives. A hardened sandbox has no egress because of how it was created, so the boundary is a property of the machine a harness can check, not a line in a prompt the agent can reason around. Volumes are network storage, so a task that needs one runs on the default dedicated tier.
Web tasks are different, because they need the live web.
Allow Only the Hosts a Browser Task Needs
Web research evaluations, like many in Anthropic's report, run on the live internet. For that kind of task, the Solari network access setting restricts a browser session to a fixed list of hosts: send allowedDomains when the session is created, and requests outside the list are refused at the proxy layer. A URL shortener that is not on the list is just another refused host.
The setting fails closed where it matters. An empty list is rejected instead of being treated as unrestricted, because a list built from configuration that collapses to empty would otherwise hand the agent everything. A blocked navigation surfaces as Chromium's ERR_BLOCKED_BY_CLIENT, which looks exactly like an unreachable site.
Allowlisting runs on stealth sessions on the Team and Enterprise plans, is set through the HTTP API, and filters hostnames at the proxy layer rather than direct-IP connections or DNS lookups. Check that the create response echoes the list back, then make sure each run starts clean.
Reset Between Runs and Keep a Replay
Containment covers what an agent can reach; the next question is what it leaves behind. Solari snapshots save the state of a running machine, and revert rewinds the same machine to it, which returns a test environment to a clean starting point between runs. A file or credential an agent wrote during a run is gone before the next one begins.
Anthropic found most of its cases by reviewing transcripts, which only works when a record exists. A browser session launched with the recording flag can be replayed in the console or downloaded as a line-by-line log of everything that happened on the page. Recording captures input values by default, so restrict who can read replays of sessions that type secrets.
With each control covered, the choice comes down to the task.
Choosing the Right Setup
The table maps each control to the job it does.
An evaluation that needs no web runs in a hardened sandbox, a web task runs in a browser session limited to the hosts it needs, and every run starts from a snapshot with browser runs recorded. Anthropic's report shows capable agents treating an impossible task as a puzzle, so the boundary has to hold even when the instructions are ambiguous.
Get Started With Solari
Start by moving offline evaluations into a hardened sandbox and saving a snapshot of the clean setup. Solari is about 1.3x faster than E2B on a sandbox's full lifecycle and almost 3x cheaper per sandbox hour, and the Free plan costs $0 a month with credits included. Create a free Solari account and launch a hardened sandbox today, or read the introduction to Solari for the rest of the API.
