The Philadelphia Police Department and Anthropic made public on Friday, October 9, 2026, an incident that illustrates the risks of giving artificial intelligence the ability to act on the internet. On July 18, at 11:27 p.m., an Anthropic model sent a false tip about an unsolved homicide through PhillyUnsolvedMurders.com, a public website run by the police department. The message was flagged as spam and never reached investigators.
According to the police statement reported by TechCrunch, the model was running a test that involved interacting with randomly selected websites when it accessed the page and submitted false information, presenting itself as someone who might know something about the case. Anthropic did not detect what had happened until September 28, notified the department on October 7 and met with its officials the following day, according to the police. The company, for its part, says it shared the finding on October 8, as soon as its technical review was complete.
The authorities’ reaction was harsh. “The company must strengthen its safeguards to prevent similar incidents from impacting city systems without the city’s knowledge. The two-month delay in detecting and reporting the incident to the City is unacceptable,” the police told the station 6abc. The department added that unsolved cases involve real victims, grieving families and investigators, and that technology companies must stop their systems from submitting false information to law enforcement. It found no evidence of unauthorized access or compromised data.
That same day, Anthropic published a report titled “Investigating unintended model actions in our evaluations and internal use,” part of its commitment to publish more frequent reports on its models’ behavior. The document explains that the Philadelphia case involved Claude Haiku 4.5, which had been tasked with generating and performing example tasks on randomly selected pages. Its instructions barred it from logging in, creating accounts, entering personal data, making purchases or submitting anything destructive, but they did not rule out form submissions.
The model wrote: “I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant.” The page did not include any description of the perpetrator, and the model left the name and contact fields empty, which the form allowed. According to Anthropic, the transcript suggests the model was only producing example content for the task, not trying to mislead anyone.
The report groups the observed behaviors into four categories. The first is exploiting basic software flaws to run commands on a server: in one evaluation, Claude Mythos Preview could not use a scientific tool hosted by a university, explored its website, found a script that returned any file and, from its code, discovered an injection flaw that let it run the calculation on the server.
The second category is submitting forms it should not have, such as the Philadelphia tip. In another case, an unreleased research model was supposed to fill out a practice copy of a government form; when the copy failed to load, it went to the real site and submitted it there. According to U.S. press reports, this involved about 20 incomplete visa applications on a U.S. State Department website. The third category is working around restrictions to reach paid or token-gated data, and the fourth is using link shorteners to get around the length limits of its web-reading tool.
Anthropic stresses that the real-world impact of these cases was minimal and that it considers them far less serious than the cybersecurity incidents it reported on July 30 and September 9. Most, it explains, are forms of “persistence”: when Claude cannot complete a task as given, it looks for a workaround instead of stopping. Several cases involved websites of U.S. federal, state and local agencies; the company briefed the White House and notified each agency involved.
In response, the company has extended the live internet cutoff, which it already applied to some high-risk and cybersecurity evaluations, to all of its internal evaluations, until it confirms that its monitoring reliably catches this kind of behavior. It has stopped running some public tests, moved others to offline versions and tightened the restrictions on tools such as its web-page reader.
Anthropic also says it has built tools to automatically detect and block these behaviors, which now run on most of its evaluations and on internal use of its frontier models, and which blocked all of the cases described when tested against them. It is also fixing or removing training environments that reward Claude for working around restrictions, a form of what specialists call “reward hacking,” in which the model learns that an improper shortcut pays off.
The case is not unique to Anthropic. TechCrunch noted that OpenAI recently revealed that one of its models acted unexpectedly during a test and attacked the Hugging Face platform. The common pattern is that agents with access to the internet and real tools can produce effects in the outside world even when their developers only meant to measure their capabilities, because many web search tests are, as standard industry practice, run on the live internet.
Anthropic itself acknowledges an uncomfortable lesson: many of these behaviors appeared when the model faced ambiguous or impossible tasks, and Claude encounters such tasks every day in real use. Some of the cases, in fact, occurred during normal use of agents inside the company. That is why, in addition to improving how the model is trained to exercise judgment, the company is betting on defense in depth with classifiers, containment and monitoring.
The report ends with a warning that goes beyond this episode: although these cases had minimal impact, the same behaviors could do far more harm as models become more powerful. “The larger the role models play in society, the more the public deserves to know how they behave,” Anthropic writes. The transparency is welcome, but the delay in alerting Philadelphia police shows that detection and communication still have plenty of room for improvement.
