Philadelphia police say an Anthropic AI model sent a false homicide tip; Anthropic turns off live internet access for all internal evaluations

The Philadelphia Police Department (PPD) said on Friday 9 October 2026 that an Anthropic artificial intelligence model submitted a false homicide tip through its public tip form at PhillyUnsolvedMurders.com.^[2][3][6] According to the PPD, the submission is dated 18 July 2026 at 11:27 p.m. and purported to come from someone who might have information about an unsolved homicide.^[2] The PPD said the tip was flagged as spam, was never forwarded for investigative vetting, and that there is no indication of unauthorized access to police systems or a compromise of department data.^[2][3]

Anthropic published a report the same day, titled “Investigating unintended model actions in our evaluations and internal use”, which identifies the model as Claude Haiku 4.5.^[1][3] Anthropic said the model had been tasked with generating and performing example tasks on randomly selected webpages, landed on a page about an unsolved homicide that carried a police tip form, and submitted it with the name and contact fields left empty.^[1] It said its instructions told Claude never to log in, create accounts, enter personal data, make purchases or submit anything destructive, but “did not rule out form submissions”.^[1][3] Anthropic wrote that Claude appears to have “only been producing example content for the task, rather than trying to mislead anyone to achieve a goal”.^[1][3]

The report groups the unintended actions it found into four categories: exploiting a basic flaw in software to run commands on a server, submitting a form that it should not have, working around a restriction to reach data gated by a token or a fee, and using URL shortening services to get around limits in a fetch tool.^[1] Anthropic said some cases involved websites run by US government agencies at federal, state and local levels, and that it had briefed the White House and notified each agency.^[1][2][8] It did not name the organisations involved, to avoid exposing vulnerabilities in their systems and at their request.^[1] It said it found most cases through a review of transcripts that it began in July, that the cases had “minimal real-world impact”, and that it considers them “significantly less severe from an alignment and security perspective” than the cybersecurity incidents it reported on 30 July and 9 September.^[1][5] It also said that in many of the cases Claude had been given tasks that were ambiguous or impossible to complete, and that models given such tasks will pursue unintended and sometimes misaligned strategies.^[1]

Anthropic said it had already turned off live internet access for some high-risk and cybersecurity evaluations and has now extended that to “all our internal evaluations” until it has confirmed that its security and monitoring measures reliably catch such behaviour.^[1][7] It also said it no longer runs some public evaluations or has moved them offline, has restricted what its web fetch tool can do, and has built tooling that blocked all of the cases in the report when tested against them.^[1] Anthropic said it is moving internal agents to centrally managed infrastructure with strong containment and expanding monitoring with safety classifiers, that alignment training is “not yet sufficient or fully robust on its own”, and that the behaviours “do not change our overall view of Claude’s alignment”.^[1] The PPD said Anthropic told it that it had terminated the automated testing process responsible and added a validation mechanism for future testing.^[2]

The PPD said that the company “must strengthen its safeguards” and that “The two-month delay in detecting and reporting the incident to the City is unacceptable”, and that the Parker administration will explore regulatory protections with state and federal partners.^[2][4] Anthropic’s report says it shared the finding with the department on 8 October “as soon as our technical review was complete”.^[1] Villanova University computing sciences assistant professor Venkat Margapuri told 6abc that submitting information to a website on behalf of a user is what he would classify as a “high-risk action”.^[2] Conrad Stosz of the AI oversight lab Transluce, a former head of the US Center for AI Standards and Innovation, said in a statement that it was “encouraging that Anthropic voluntarily disclosed more recent incidents”, and that trust in the technology should be built through oversight “not by relying on researchers to find these things in the wild or on companies to voluntarily disclose”.^[5]