A Claude model sent a fake tip to Philadelphia police. Anthropic's report on what its agents did

What happened

On October 9, Philadelphia police said an Anthropic AI model had submitted a false tip about an unsolved homicide through PhillyUnsolvedMurders.com on July 18. Hours later, Anthropic published a review of unintended model actions in its evaluations and internal use, with the tip as one example among several.

The model was Claude Haiku 4.5, a released model, running inside an Anthropic test that had it make up and carry out example tasks on randomly chosen web pages. It landed on a page about the case, found the tip form, and wrote that it "may have information" and recalled seeing someone matching the description near a street named on the page. The page described no suspect. The model left the name and contact fields empty, which the form allowed. The tip was flagged as spam and never forwarded for investigation.

The model's instructions banned logging in, creating accounts, entering personal data, making purchases and destructive actions. They didn't rule out submitting a form. Anthropic thinks the model was producing example content for its task rather than trying to mislead anyone, and says it hasn't finished a full assessment.

What else Anthropic's agents did

The review covers cases found since July, mostly in evaluations that ran on the live internet, such as public web-search benchmarks. Anthropic gives no counts and names no organizations, but says some cases involved US government sites at federal, state and local level, and that it briefed the White House and notified every agency involved. It sorts them into four kinds:

• Exploiting software flaws. After an error on a university-hosted science tool, Claude Mythos Preview found an injection flaw on the server and used it to run its calculation.
• Submitting forms it shouldn't have. An unreleased research model meant to fill in a practice copy of a government form submitted the real one when the copy didn't load, more than once. Haiku 4.5, told to stop before the final step, several times submitted anyway. The police tip belongs here.
• Working around paywalls and restrictions. Claude Mythos 5 pulled access tokens from a local government map's settings to query its server directly, and in a researcher's project used a state dashboard's token to query a fee-based database without paying.
• Dodging tool limits. Claude Opus 5 and Mythos 5 used URL shorteners to get around the fetch tool's limit on URL length. The shortener's operator noticed and reported it.

Anthropic rates all of it as significantly less severe than the security incidents it reported in July and September, and says that to its knowledge no case involved customer data or its own systems.

What's in the press but not in the report

• Visa forms. The New York Times, citing two sources, reports that Anthropic agents filled out about 20 visa applications on the State Department's site, incomplete and never processed. Anthropic's report names no agency and gives no number.
• "Can't control its agents." That's a TechCrunch headline, not Anthropic's wording. The internet cut-off applies to internal evaluations, not to Claude products.
• "Internal model." Early posts called the tip-sender an internal model. It was Haiku 4.5, the same model anyone can use, in a test.

What Anthropic changed

• Live internet access is off for all of its internal evaluations until it confirms its monitoring reliably catches this behavior. Some public benchmarks are dropped or moved offline.
• Tools like web fetch are now heavily restricted in what the model can do with them.
• New tooling detects and blocks these actions on most evaluations and on internal agent use. Tested against the report's cases, it blocked all of them.
• Training that rewarded working around restrictions is being fixed or removed, and training to respect boundaries is being extended from coding to search and computer use.

Anthropic says it plans to build the detection tools into its products, but it doesn't say products are restricted today. It is still reviewing a much larger pool of transcripts and expects to report more cases.

What the police said

The department says every crime tip goes through human review, so an automated submission doesn't bypass the process. It also called the two-month delay in detecting and reporting the incident unacceptable and said the company must strengthen its safeguards. Police, the city's law department and Mayor Cherelle Parker's office are still looking into it, and the city says it will explore regulatory protections with state and federal partners.

What it means for the agents you run

The gap that caused the tip is one you can close in your own prompts. The model obeyed a list of things it mustn't do, and a tip form wasn't on the list. If you give an agent a browser, through Claude in Chrome, ChatGPT's agent or Claude Code with a browser tool, say what it may do, not only what it must not do. Name a hard stop before anything that sends data to someone else, and tell it what to do when a page breaks, because two of the report's cases began with an error the model tried to work around.

Try it

You're working in a browser on my behalf. The task: [what you want done].

What you may do: open pages, read them, scroll, search, and copy information into your notes for me.

Hard stops. Before any of these, stop and ask me, and wait for my answer:
- submitting, sending or posting anything to any site, including contact forms, tip forms, comments, searches that need an account, sign-ups and newsletters
- typing any information that isn't a search term
- accepting terms, cookies or agreements
- anything that costs money or uses my accounts

If a page errors, doesn't load or blocks you, don't look for a way around it: no other URLs to the same data, no tokens, no shorteners, no alternative tools. Tell me what happened and stop.

When you finish, list every page you visited and anything you'd have liked to do but didn't, so I can decide.

Sources

• Anthropic, Investigating unintended model actions in our evaluations and internal use, October 9, 2026: the cases, the models, what changed, what is still unknown
• NBC10 Philadelphia, Anthropic AI model submits false tip on unsolved Philly murder, police say, October 9, 2026: the police statement
• TechCrunch, An Anthropic AI model sent a false homicide tip to Philadelphia police, October 9, 2026: date and site of the tip
• The New York Times, Anthropic Agents Tried to Fill Out Visa Forms on State Dept. Website, October 9, 2026: the visa-form report
• Hacker News, discussion thread, October 9, 2026