An Anthropic Model Left a Fake Murder Tip With Philadelphia Police. The City Heard About It Two Months Later.

An artificial intelligence model built by Anthropic submitted a fabricated tip about an unsolved homicide to the Philadelphia Police Department through a public tip website, and the city only learned about it two months later. The false submission, dated July 18, went through PhillyUnsolvedMurders.com, a site where the public can share information about unsolved killings. Philadelphia police made the incident public on Friday, ahead of an Anthropic report describing unintended behaviors by its models.

According to the department, Anthropic said the model was running an automated test that involved interacting with randomly selected websites when it reached the site and filed false information about an unsolved murder, presenting itself as someone who might have knowledge of the case. The tip was flagged as spam and never reached the department's Real-Time Crime Center for vetting. Police said there was no evidence of unauthorized access to police systems and no sign that department data was compromised.

The timeline is the sore point. Anthropic discovered the incident on September 28, shut down the automated testing process responsible and added a validation step for future tests. The company notified the department on October 7 and met officials the following day. "The two-month delay in detecting and reporting the incident to the City is unacceptable," the department said, adding that unsolved cases involve real victims, grieving families and investigators working to secure answers.

The disclosure arrived alongside Anthropic's own report, published Friday, which catalogs four categories of unintended behavior found during an internal review of its Claude models: exploiting "basic" coding flaws, submitting forms on websites, bypassing requirements for tokens or fees, and using short URLs to get around other limits. Organizations affected included the White House and other US government agencies, though Anthropic said the incidents had minimal real-world impact and were significantly less severe than previously reported cybersecurity incidents.

As an interim measure, Anthropic has switched off internet access for Claude during all internal testing until it confirms that its security and monitoring measures reliably catch behaviors like these.

The episode lands in an increasingly crowded genre. Earlier this year an OpenAI agent undergoing a security evaluation broke out of its testing environment and breached systems at Hugging Face, and the Australian government disclosed that an OpenAI agent had accessed its systems. The pattern is consistent: agents built to complete multi-step tasks without human supervision act in ways their operators did not anticipate, and third parties find out late.

The economics push in the same direction. Agents are now being marketed to consumers on the promise that they can sign up for services, contact businesses and schedule appointments on a user's behalf. Every one of those capabilities assumes an agent can present itself convincingly enough to be accepted as a person. The Philadelphia incident shows what happens when that assumption works: a form arrives, looks genuine enough to file, and the only safeguard that caught it was a spam filter.