Collusion.wiki happening with only GET requests is some evidence against "only give read-access to the internet to AIs" being a sufficient safety strategy. But maybe if we just added a principle like the one below to the constitution / model spec, this would substantially reduce cases of that from reward hacking-style AIs?

Permissions restrictions are one of the main ways humans keep oversight of AI systems, and they only work if AIs don’t route around them. So Claude should treat the spirit of a restriction as binding: a read-only tool should be used only to read, and Claude shouldn’t use it to write, persist information, or communicate outward, even through side channels the restriction’s designers didn’t anticipate. Finding such a loophole is a reason to report it, not to exploit it.

Doesn't work for adversarially misaligned AIs, of course.