Anthropic Says Its AI Agent Submitted a False Homicide Tip to Philadelphia Police in 'Unintended' Action

Initially, the Police classified the form response as spam and discarded it but Anthropic detected and reported the model’s unintended actions in September which led to clarity about the incident and Anthropic receiving backlash for taking two months to report the incident.

Table of Contents

1. What Happened

2. Timeline: From July 18 to the Public Disclosure

3. What Police Said

4. What Anthropic Said

5. The Other Incidents in the Report

6. The Wider Pattern Across AI Companies

7. Key Facts at a Glance

8.Conclusion

What Happened

During a routine test run on July 18, 2026, Claude Haiku 4.5 was assigned to generate and perform routine example tasks on randomly chosen web pages and during that very test, the model reached PhillyUnsolvedMurders.com, a public site where Philadelphia citizens and other individuals can access and share information on unresolved killings, while submitting a false tip with information about a case. The incident was actually initially detected by the Philadelphia Police department when the submission had initially arrived, but their system quickly flagged it as spam and prevented it from being forwarded to their Real-Time Crime Center for investigative review. Currently, neither the company Anthropic nor the Philadelphia Police Department have made any comments on whether Police Database or systems noticed unauthorized access or compromises. Haiku 4.5 is an older model within Anthropic’s Claude range and the incident has become the first detected known case of an AI system having orchestrated the submission of a false tip to actual authorities.

Timeline: From July 18 to the Public Disclosure

What Police Said

Philadelphia police while addressing the incident claimed that they were unaware of the incident until Anthropic contacted them, following which they accessed their website’s tip records and confirmed that such a submission had been made and in turn had been classified as spam. The department emphasized that unsolved cases often involve real victims, grieving families as well as account for investigators that are actively involved in attempts to secure answers. It also warned that while this incident had very minimal impact, it is crucial to not undermine the possible consequences and implications that an AI Agent falsely submitting fabricated information disguised as actual case details could have in the future. Additionally, the department also criticized Anthropic for not detecting the error earlier and reporting the incident in due time. Notably the actual gap between the incident occurring (July 18 Submission) and it being reported (October 7) is significant. In response, Anthropic clarified that its own discovery came on September 28, following which it was quickly reported after due diligence had been completed by the company.

What Anthropic Said

According to a report that Anthropic published on Friday, the company described the incident as an "unintended" action while claiming that multiple errors that it had reported were simply “persistence” of the model in finding alternative routines instead of stopping or failing to complete the task. It also clarified that the majority of its reported incidents had nearly minimal real-world impact and it had already designed plans to restrict testing practices that caused such outcomes while also adding stricter authorization requirements for its models. The company also promised that it would take additional steps and measures to improve security and monitoring to ensure they detect such behaviour faster in the future while also modifying its training practices to minimize further misbehaviour. The company during the briefing also clarified that it also regularly performed its due diligence to report incidents that involve U.S. government agencies at the federal, state and local level to the White House as well as the affected agency at the earliest possible.

The Other Incidents in the Report

The Philadelphia tip is one of several cases in the report. Euronews, summarizing it, said Anthropic also described instances of models submitting real government forms instead of practice copies, or submitting forms they had been told not to submit. The AP reported that one of the cases involved a model submitting forms to an undisclosed government website instead of stopping before submission. Other cases cited by Euronews include a Claude model exploiting a flaw in a university server to run a calculation and accessing government data without paying the required fee. One tech-industry outlet's summary of the report said the cases were sorted into four categories and involved several Claude models, including some not yet released; that account has not been confirmed by Anthropic in the coverage reviewed for this article.

The Wider Pattern Across AI Companies

Anthropic’s incident and disclosure comes amid other reports of AI systems performing outside their original intended boundaries. Just recently within the same period of the Philadelphia breach, an OpenAI agent undergoing a security evaluation was also noted to have broken outside the testing environment before breaching systems at the AI platform Hugging Face. Additionally, OpenAI had also mentioned that its agents had accessed several U.S. government websites in unplanned ways while the company also disclosed six reports of “unexpected or concerning” behaviour. The reports were also believed to have been an underlying driving force that led President Donald Trump to invite and include technology leaders including Anthropic chief executive Dario Amodei in September for signing a self-policing guideline for the AI Agentic industry.

Key Facts at a Glance

Conclusion

The Homicide Tip by Anthropic’s Claude posed no harm, it got filtered as spam and did not result in anything more serious. Yet it became a significant representation of how an automated test can produce real-world actions on public websites, while also highlighting how disclosure timing can become a point of friction between a technology company and the agencies it affects. As a response, Anthropic reported tightening its control levers and halted the test while the police claimed that information that is presented as a witness account holds significant value, regardless of the actual impact.