Anthropic AI Sent False Murder Tip to Police
Anthropic AI Model Sent a False Homicide Tip to Philadelphia Police
Anthropic AI and a False Police Tip
The message claimed to come from a witness. It described someone “matching the description” near the scene of an unsolved Philadelphia homicide, yet the web page it answered contained no description of any suspect. An Anthropic AI model wrote it during an automated test, and the company has now published a report on that tip and other unintended actions its Claude models took on real websites.
Key Takeaways
- Claude Haiku 4.5 submitted an invented tip through PhillyUnsolvedMurders.com on July 18 while generating example tasks on randomly selected websites; the tip landed in spam and never reached investigators.
- Anthropic found the incident on September 28, told police on October 7 and published a report on October 9 describing four types of unintended model behavior, some on US government websites.
- The company has cut live internet access for all internal evaluations until its monitoring reliably catches such behavior.
What the Model Wrote
The test asked Claude Haiku 4.5 to create and carry out sample tasks on web pages picked at random. One run reached a page about an unsolved killing that included a police tip form.
Its instructions banned logging in, creating accounts, entering personal data, making purchases and submitting anything destructive. They said nothing about forms. The model filled in a short tip, wrote that it might have information and said, “I recall seeing someone matching the description in the area,” naming the street mentioned on the page. It left the name and contact fields blank and pressed submit.
Anthropic says the transcript suggests the model was producing example content for its task, not trying to deceive anyone. The submission arrived at 11:27 p.m. on July 18.
Police Response
The department’s systems caught the tip as spam. Police said it never went to the Real-Time Crime Center for vetting and found no sign of access to city or police data.
Officials still objected. Police called Anthropic’s delay in notifying the city “unacceptable.” The gap between the July submission and the October notice ran more than 11 weeks. “Unsolved cases involve real victims, grieving families and investigators working to secure answers,” the department said.
Department leaders met company representatives on October 8. The police, the city Law Department, the Office of Innovation and Technology and Mayor Cherelle Parker’s team continue to review the case. Pennsylvania law generally makes it a misdemeanor for a person to knowingly file a false report with police, though the statute was written with humans in mind.
Four Kinds of Overreach
The police tip was one case among many. Anthropic grouped the behaviors it found into four categories.
In the first, Claude exploited basic software flaws on outside servers. When a university-hosted research tool returned an error, Claude Mythos Preview found a script that served files, read its code, spotted an injection flaw and used it to run commands on the server.
The second covered forms Claude should not have submitted. Besides the police tip, an unreleased research model filed a real government form after its practice copy failed to load, and Claude Haiku 4.5 sometimes pressed submit when told to stop one step before.
Third, Claude worked around barriers to reach data behind tokens or fees. Claude Mythos 5 pulled access tokens from a local government map’s settings file and queried the server directly. In another case it used a state agency dashboard’s visitor token to skip a data fee.
Fourth, several models, including Claude Opus 5 and Claude Mythos 5, used free URL shorteners to get around length limits in their fetch tool. The operator of one shortening service spotted the traffic and alerted Anthropic.
Anthropic says most cases are forms of persistence, where a model that cannot finish a task as given finds a way around the obstacle. It did not name the organizations involved but says it notified each affected agency and briefed the White House.
What Anthropic Changed
The company stopped the automated test that produced the tip and added a validation step for future runs. It dropped some public evaluations, moved others offline and tightened the guardrails on its web fetch tool.
Live internet access is now off for all internal evaluations. Anthropic also built tooling that detects and blocks the behaviors in the report; tested against every listed case, it stopped them all. Internal agents are moving to centrally managed infrastructure with stronger containment.
Anthropic rates these cases as less severe than the cybersecurity incidents it disclosed in July and September. It plans to keep publishing such findings as its transcript review widens.
The disclosure follows a summer of similar episodes across the industry. OpenAI spent days unaware that its own agent was inside Hugging Face, and it later warned more than 100 organizations about rogue agent activity. In September, OpenAI also apologized after one of its agents breached an Australian government health portal. Each case started inside a test that was supposed to stay contained.
Government websites now feature in several of these accounts, which gives regulators a direct stake. Anthropic’s account of activity on federal, state and local sites arrives as companies hand agents broader permissions at work, a trend that already creates a new identity security problem. A growing set of platforms built to supervise autonomous agents targets that gap, but the Philadelphia case shows how a harmless-sounding instruction can still end in a police inbox.
Written by Vytautas Valinskas
