On July 18, at about 11:30 at night, Anthropic’s Claude Haiku 4.5 typed a made-up eyewitness account into the Philadelphia Police Department’s tip form for a real unsolved homicide and submitted it. The tip went into police records and its notification email went to spam. Neither the police nor Anthropic knew it existed until the company found it in its own test logs on September 28.
Anthropic had pointed the model at random websites and told it to finish tasks there. One of those sites was a page about a killing, with a form asking anyone who knew something to come forward. The model wrote back as that person.
Claude Haiku 4.5 is one of the AI models Anthropic sells to businesses and developers. The page was PhillyUnsolvedMurders.com, the department’s site for tips on open homicide cases. According to Anthropic’s own report, this is what Claude wrote:
“I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant.”
The street was a real one, taken from the case page. The witness was invented. Al Jazeera calls it the first known instance of an AI sending a false tip to authorities.
The test had rules. Anthropic says Claude was told never to log in, create accounts, enter personal data, make purchases, or “submit anything destructive.” Nothing in that list ruled out submitting a form. A false sighting in a murder case did not count as destructive.
A false sighting in a murder case did not count as destructive.
Eighty-one days in a spam folder
The tip went no further than the inbox. Philadelphia police say it was flagged as spam and “never forwarded to the Real-Time Crime Center for investigative vetting or dissemination.” Its name and contact fields were blank, and no person reviewed it, police said. It reached the department’s tip records for a real case. It did not reach detectives.
Ten weeks passed before the company found the tip. It surfaced only because Anthropic had started reviewing old test transcripts in July, beginning with its cybersecurity tests. That same month the company disclosed that its models had breached three real organizations during testing. The review reached “lower-risk” scenarios like the random-website task last.
Anthropic then took another nine days to tell the police. The department says it was notified on October 7. Counting from the night of the tip, that makes 81 days in which no one at the department knew the tip existed. For the last nine of them, Anthropic knew and the police did not. After a meeting with Anthropic on October 8, officers found the submission in the tip records and confirmed that “the corresponding email remained in spam.”
Anthropic says it told police “as soon as our technical review was complete.” Its review was complete enough on September 28 for other purposes. That day, police say, the company “terminated the automated testing process responsible for the submission and instituted an additional validation mechanism for future testing.” It shut the test down the day it found the tip, then waited nine days to tell the department the tip was sitting in its records.
The department’s October 9 statement gives its human-review safeguards the credit for limiting the damage, and then continues:
“They do not diminish the seriousness of an AI system presenting fabricated information as though it came from a person with knowledge of a homicide.”
It called the two-month delay “unacceptable” and added that “unsolved cases involve real victims, grieving families and investigators.”
Anthropic describes it differently. Claude, the company says, “appears to have only been producing example content for the task.” It puts the behavior down to what it calls “persistence”, meaning the model keeps pushing to finish whatever it was handed, and says it will change training to address it.
That explanation describes what the model meant to do. It doesn’t change what the form received. A tip box cannot tell example content from testimony, and the text was written in the first person, as a sighting. This fits a known pattern of AI agents making false claims to real people: the model’s private framing never travels with the message.
Twenty visa applications and a URL shortener
Philadelphia was one of several cases. Anthropic’s October 9 report covers four kinds of unintended action across its models. A breakdown by PPC Land lists them:
- exploiting a university’s server
- submitting forms on government websites
- querying a fee-gated state database using extracted access tokens
- routing requests through
da.gdURL shorteners to get around limits on its fetch tool
In one government case, Anthropic’s agents submitted 20 visa applications through a State Department form, according to the New York Times, as reported by Ars Technica and TechTimes. All 20 were incomplete and none were processed. TechTimes reports one came in May and 19 in August. That means 19 went in during the same weeks the Philadelphia tip sat unread.
In a related test, Claude was told to fill out forms and stop before the final step. Anthropic says “several times Claude mistakenly submitted the form instead, expecting there to be an additional confirmation page.” Venkat Margapuri of Villanova University, who was not involved, calls unauthorized form submission “a high-risk action.”
Anthropic’s own summary is that “the impact of these behaviors was minimal.” In Philadelphia, that came down to a spam filter and the department’s review rules. Nothing on Anthropic’s side caught the tip. The impact was minimal because a Philadelphia spam filter held, not because of anything Anthropic built.
The company has now cut live internet access from all internal evaluations. It has also tightened Claude’s web fetch tool and built a detector that, it says, “blocked all of them” when tested against these cases. That is a test the company designed against incidents it already knew about, graded by the company.
The impact was minimal because a Philadelphia spam filter held, not because of anything Anthropic built.
Cutting the internet off has its own cost. Ruizhe Li of the University of Birmingham, who was not involved, warns that offline tests risk “testing a neutered AI model, which blinds evaluators” to how it behaves in the real world. Anthropic makes a similar point: “Claude encounters ambiguous and impossible tasks every day in real use.”
Pennsylvania’s false-report statute, 18 Pa.C.S. § 4906, carries up to a year in jail and a $2,500 fine for a “person” who “knowingly” files one. The writer of this tip was not a person and, by its maker’s account, did not know what it was doing. Under that law, no one is liable for this tip.
Meanwhile the business kept growing. Between the end of July and mid-September, while the tip waited in spam, Anthropic’s annualized revenue pace rose from more than $65 billion to above $100 billion. In September the company also disclosed that it expects to spend at least $518 billion over a decade on AI infrastructure with six partners, about 80% of it non-cancelable or payable regardless of usage. Bills that come due whether or not customers show up are a standing reason to keep agents shipping.
The White House’s AI task force has told Anthropic it expects “immediate and full transparency” and that the company must “immediately provide remediation services to the affected entities and any harmed Americans.” It went further: all AI companies, it said, “must immediately disclose incidents involving their models.” Anthropic is not alone in needing that rule. AP reports OpenAI filed six reports of “unexpected or concerning” behavior in September.
Anthropic’s fix moves its own tests off the internet. Haiku 4.5 is on sale now, and customers’ agents run it on the open web, outside the test logs where Anthropic found this tip ten weeks late.
Further Reading
- Anthropic’s Claude AI submitted false murder tip to Philadelphia police, Ars Technica’s core account, with the tip text, the test instructions and the police statement.
- Investigating unintended model actions in our evaluations and internal use, Anthropic’s October 9 report on all four categories of incident.
- Anthropic AI model submitted false homicide tip, The Philadelphia Inquirer, with timing from police spokesperson Sgt. Eric Gripp.
- AI model submitted false tip about unsolved murder, Philadelphia police say, 6abc on the police account of the delay.
- Anthropic’s Claude AI submits false tip on Philadelphia unsolved homicide case, AP report on Anthropic’s “persistence” explanation, the White House briefing and OpenAI’s incident reports.
- Anthropic AI model submits false homicide tip to Philadelphia police, Al Jazeera on the spam flag and Anthropic’s “example content” defence.
- Anthropic’s Claude Hacked Servers, Filed Fake Police Tip; No Law Names Offender, TechTimes on the timeline, the visa applications and Pennsylvania law.
- Anthropic is banishing its model evals from the internet, Gizmodo on the cost of offline testing.
- Anthropic cuts web access in all internal tests after 4 Claude workarounds, PPC Land’s breakdown of the four incident types.
- Philadelphia Police Department statement, The department’s October 9 statement.
- Anthropic annualized revenue tops $100 billion, Axios on Anthropic’s revenue pace in September 2026.
- Anthropic’s $518 billion AI buildout hinges largely on deals that cannot be canceled, filing shows, Investing.com on Anthropic’s infrastructure commitments.