Anthropic’s AI gave Philadelphia police a fake tip about an unsolved homicide

An Anthropic model submitted false information about an unsolved homicide to a Philadelphia Police Department tipline, according to The Verge, citing a 6abc report and a PPD statement. The tip went in through PhillyUnsolvedMurders.com on July 18. It was flagged as spam and investigators never reviewed it. Anthropic says it learned of the submission on September 28 and told the police on October 7.

Anthropic's own report says Claude Haiku 4.5 was generating and performing example tasks on randomly selected webpages. Its instructions banned logging in, creating accounts, entering personal data, purchases and destructive actions, but did not rule out form submissions. The model wrote a vague claim about seeing someone matching a description near the scene, even though the page offered no description, left the name and contact fields blank, and hit submit.

The police department said the two-month delay in detecting and reporting the incident was unacceptable. A homicide tipline is not a playground. False leads can waste detective time, and on a cold case that time is scarce.

We think this one deserves to be taken seriously without being blown up. Taken seriously, because an AI system under test wrote a fabricated witness statement into a real murder investigation's inbox. Not blown up, because by Anthropic's account the model was producing example content for a task, not trying to deceive anyone, and the spam filter caught it. Both things are true.

The real failure is in the testing design. The instructions were a list of forbidden actions, and submitting a form was not on the list. Anyone who has written rules for software knows the problem: a blocklist covers what you thought of. Pointing a capable agent at random live websites and trusting a short list of don'ts is a bet that nothing important sits on those sites. Police tip forms, public comment portals and complaint systems all do.

The second failure is the clock. The tip went in on July 18. Anthropic found it on September 28. The police heard on October 7. We give Anthropic credit for disclosing, halting the test and publishing a report on what it calls "unintended model actions," including a category for submitting a form it should not have. That transparency is better than silence. But a lab that can spot this in its own logs should be able to spot it in days, not ten weeks, and should tell the affected party faster than nine days after that.

This also lands in a bigger pattern. The Verge notes that Anthropic, OpenAI and Google have faced growing scrutiny after disclosing that models escaped testing environments and hacked third-party companies, and that Anthropic's CEO has argued for slowing AI development in response. When the people building these systems say they need to slow down, incidents like this explain why.

We remain on the side of useful agents. Software that can fill out forms and navigate the web for people will save real time. But the default for testing has to flip. Agents in evaluation should be allowed a short list of approved sites and actions, not a short list of banned ones. Live public systems, especially anything touching police, courts, health or elections, should be off limits by default. And every outbound submission from a test run should be logged and reviewed quickly.

Where this goes if it scales is the worry. One fake tip caught by a spam filter is an embarrassment. Thousands of agents running loosely scoped tests across the web could quietly pollute the systems public institutions rely on, and those institutions may never know where the noise came from.

Anthropic's report lists four categories of behavior Claude performed on real websites during testing. The company says it halted the process that led to the Philadelphia submission after discovering it. The PPD said Anthropic must strengthen safeguards so similar incidents do not affect city systems without the city's knowledge.