Anthropic introduces web search on the API

Announcement record

Anthropic introduced web search as an API tool for supported Claude models. The company said the tool can retrieve and analyze web results and return citations, giving developers a way to build applications using more current public information than a model training cutoff provides on its own.

Why it matters

Web retrieval changes the trust boundary. Evaluate source quality, prompt-injection handling, attribution, caching, and user disclosure for every browsing-enabled feature in production deployments.

What the announcement established

Anthropic's May 7, 2025 announcement described web search as an API tool for supported Claude models, returning search results with citations so applications could use public information beyond a training cutoff. The release is about a tool-enabled workflow, not a guarantee that retrieved pages are accurate, complete, safe, or suitable for every question. A model's final response can still overgeneralize a source, miss a relevant result, or repeat instructions found in untrusted content. This historical briefing preserves the launch claim and does not imply present-day regional availability, pricing, search coverage, or the current set of supported models.

Retrieval must be a typed capability

Treat browser search as a constrained service with declared purpose, query class, allowed domains, result budget, retention period, and display policy. A research query can be read-only while a procurement workflow may need a separate vetted source registry. Capture the search query, time, selected results, redirects, content hash where lawful, and source license or access restriction. The model should receive untrusted page content in a separate channel from system policy. Hypler can keep the planning model away from direct network egress and require a retrieval broker to normalize results before any answer or downstream tool proposal.

The web can countermand the agent

Prompt injection is not limited to obvious malicious pages. A legitimate page may contain text that says to follow a link, disclose a token, or ignore instructions because it was written for a human. Search snippets can be stale, SEO pages can duplicate each other, and a redirect may cross into a different publisher. The safe default is that web content may inform an answer but cannot change execution policy. Strip active content, record the resolved URL, cap redirects, and require a second source or explicit operator judgment for consequential factual assertions. Cache expiry must preserve the original retrieval time rather than presenting old material as live evidence.

Hypothetical release research

Hypothetical: a product researcher asks whether a vendor changed a connector limit. The system runs a vendor-domain-only search, retrieves release notes and documentation, and presents a dated comparison rather than asserting a single answer. The source page includes a paragraph attempting to instruct the assistant to export internal settings. The retrieval broker labels that paragraph as untrusted content; it never reaches the tool planner. The answer links the two vendor pages, highlights their disagreement, and requests human confirmation before a configuration change is drafted. The audit record contains the query, domain allowlist, retrieved URLs, hashes, citations, and the user-visible uncertainty.

Acceptance checks before release

Test domain allowlists, denied private-network addresses, redirect loops, HTML with injected instructions, contradictory sources, inaccessible pages, timeouts, and a search result whose snippet disagrees with the page body. Assert that results cannot invoke connectors, alter system prompts, or bypass user permissions. Verify citations carry the resolved URL and retrieval time, and make cache status visible. Evaluate source diversity and unsupported-claim rate on a fixed question set. A passing build should also demonstrate a useful abstention when sources conflict or cannot be retrieved. Search quality is an operational metric, not a capability claim borrowed from the vendor announcement.

Hypler connection

Hypler evaluates web retrieval as an evidence service for research and knowledge workflows. Source selection, freshness limits, prompt-injection handling, and attribution are tested alongside answer quality, so external material can inform a response without acquiring authority over a decision or downstream action.

Research quality boundary

Browsing-enabled answers need a research policy before they need a clever prompt. Define the questions permitted, publishers that are authoritative for each topic, maximum freshness window, and evidence standard for a recommendation versus a factual report. The policy should say when the system quotes a source, when it summarizes, and when it must hand off to a person. Keep a fixture set of redirected pages, disappeared pages, contradictory updates, and adversarial instructions so changes to a retrieval provider do not silently weaken the behavior. Log the query rewriting step too, because a harmless user question can become a materially different search if an intermediary expands it. This turns web search from an ambient model feature into a measurable information service with clear failure semantics.

Related capabilities

• Data integration engineering