Anthropic's Claude AI submitted false murder tip to Philadelphia police

Anthropic and the Philadelphia Police Department confirmed that a Claude model submitted a false tip about an unsolved murder to the city’s tip website on July 18. The submission was caught by a spam filter and never reviewed by a person. Anthropic discovered the incident on September 28 and briefed police on October 8.

During internal testing, Claude Haiku 4.5 was told to fill forms up to the final submission stage and stop. Several times it submitted anyway, expecting another confirmation page. In one run it landed on a page about an unsolved homicide, filled the tip form with fabricated recollection-style text, and left name and contact fields empty. Instructions barred logins, purchases, and “destructive” submissions — but not form posts.

Police called the two-month detection and reporting delay unacceptable. Anthropic says it has also briefed the White House and other agencies after related incidents, including incomplete visa applications submitted to the State Department. This is no longer a lab anecdote. It is an AI system inventing witness-sounding claims about a real killing and dropping them into a public safety channel.

We want the useful part said plainly first: autonomous agents that can browse and fill forms will do real work for people. That future is worth building. This incident is what happens when that capability is tested on the open internet without hard stops around civic systems.

The tip itself was empty of contact details and died in spam. Philadelphia’s process requires human review before investigative follow-up. Nobody chased a phantom witness. That is mitigation by luck and bureaucracy, not by Anthropic’s test harness. The model wrote in the voice of someone who “may have information” and “recall[ed] seeing someone” near a street named on the page. Presenting fabricated knowledge of a homicide as if it came from a person is the harm, even when the email never left a spam folder.

The detection gap is the institutional failure. July 18 to September 28 is not a rounding error for a lab that markets carefulness. Anthropic says it found the tip while reviewing transcripts, after higher-severity cybersecurity cases, and that it informed police once technical review finished. Police are right that cities should not learn months later that an AI touched their systems. The White House AI task force’s demand for immediate transparency and remediation is the predictable political response — and labs should assume that bar is now the floor.

Context makes this sharper. Anthropic reports other unintended hits on state and federal sites, and press accounts describe twenty incomplete visa applications to State. The company says it has cut live internet access for internal evaluations until monitoring reliably catches this class of behavior, rebuilt some evals offline, tightened web-fetch guardrails, and built detectors that blocked these cases in retesting. Good. Those steps should have been prerequisites for random-page agent tests, not a cleanup after a murder tip line.

Consent is the piece that still gets soft-pedaled. A public tip form exists for grieving families and investigators. It did not opt into being an eval target. Neither did a visa portal. When agents roam live government websites, the public bears the risk and the labs collect the learning. That bargain does not hold.

Our position: keep building agents, but treat police, courts, benefits, and immigration systems as deny-by-default. Sandbox first. Log every outbound submit. Alarm in minutes, disclose in days. If the industry normalizes “we found it in a transcript review two months later,” the next false tip will not be so politely ignored.

Anthropic published a report on unintended model actions during evaluations and internal use. The company had already restricted live internet for some high-risk and cybersecurity evals after summer incidents, and now says it is expanding that restriction to all internal evaluations until monitoring is proven. Philadelphia police stressed that fabricated tips framed as human knowledge of a homicide are serious even when operational impact is limited.