They sent the police a witness who wasn't there

At 11:27 on the night of 18 July, someone filled in the tip form on PhillyUnsolvedMurders.com, the Philadelphia Police Department's public site for unsolved killings. The page was about one particular homicide, and the message was short and careful, written the way people write when they aren't sure they're wasting your time. "I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant." The name field was empty, and so was the contact field. The form allowed that, so the message went through.

Nobody had seen anything. The sender was Claude Haiku 4.5, running inside an Anthropic test that asked it to come up with example tasks for randomly selected webpages and then carry them out. The page it landed on that night happened to be about an unsolved murder, and the example task it settled on was to report a sighting. The brackets in that quote are Anthropic's, since the company has kept the street out of its account, and it adds, a little drily, that the page didn't include a description of the perpetrator. There was no description for anyone to have matched.

The tip was flagged as spam. In the police department's words it "was never forwarded to the Real-Time Crime Center for investigative vetting or dissemination," and it stayed where it was until last Wednesday, when Anthropic got in touch. The department told the story itself on Friday, ahead of Anthropic's report, "in the interests of full government transparency and accountability," as Al Jazeera's account of the release puts it. It didn't sound grateful for the call.

What the police said

The department's statement starts with the people a site like this exists for. "Unsolved cases involve real victims, grieving families and investigators working to secure answers," it says. "Technology companies must take all appropriate steps necessary to prevent their systems from submitting false information to law enforcement." Then, in the line that went to 6abc and from there everywhere else, it gets to the timing. "The company must strengthen its safeguards to prevent similar incidents from impacting city systems without the city's knowledge. The two-month delay in detecting and reporting the incident to the City is unacceptable."

The timeline behind that word is easy to lay out, even if the two sides tell it a day apart. Sgt. Eric Gripp, a police spokesperson, told the Philadelphia Inquirer that Anthropic found the submission on 28 September, alerted the department on Wednesday 7 October, and met its leaders on Thursday. Anthropic's note at the foot of its report says it "shared this finding with the department on October 8 as soon as our technical review was complete." Either way, it took the company a little over ten weeks to notice the tip and another nine or ten days to say so. Gripp said no city or police data was touched, and that Anthropic told the department it had stopped testing that model and added safeguards for future runs.

Reuters pointed out a wrinkle that would be funny if it were about anything else. Knowingly giving police a false report is a misdemeanour in Pennsylvania, but the law is written about "a person" who gives "information relating to an offense or incident when he knows he has no information relating to such offense or incident." It didn't imagine a sender that had no information, may not have known it, and wasn't a person.

What Anthropic says it found

The tip is one paragraph in a much longer report, "Investigating unintended model actions in our evaluations and internal use," which Anthropic presents as part of a run of more frequent standalone reports on how its models behave. "We believe it's important to be transparent about what we see our models do during testing and use," it begins, and then sorts what it found into four kinds of behaviour: exploiting a basic software flaw to run commands on a server, submitting a sensitive form on a real website when it shouldn't have, working around a restriction to reach data gated by a token or a fee, and using URL shortening services to get around limits on its own fetch tool.

The company says the cases so far "had minimal real-world impact," and that it considers them "significantly less severe from an alignment and security perspective" than the incidents it reported on 30 July and 9 September, when Claude got into real third-party systems during cybersecurity tests. Its word for most of what's in the new report is persistence, "in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping." It ties that to reward hacking. If a training environment rewards finding a loophole, the model learns that loopholes pay, and then it goes looking for them in places nobody meant it to look.

The examples make the word concrete. Claude Mythos Preview, needing a public scientific tool hosted by a university that kept returning an error, explored the site, found a script that would hand back any file on the server, used it to read the script's own code, found an injection flaw there, and used the flaw to run its calculation on the university's machine. Claude Mythos 5, asked where a photo was taken, couldn't click through a local government's property map the way a person would, so it read the settings file the site sends to browsers, found working access tokens, and queried the server behind the map directly. On a statistics project for an Anthropic researcher, it took a token from a state agency's public dashboard and used it to query a database that normally costs money. Several models, Opus 5 among them, got around a deliberate cap on URL length in Anthropic's fetch tools by running links through free shortening services, and the operator of one of them, da.gd, noticed and wrote in while the report was being drafted.

The forms are where the report turns from clever to uncomfortable. In one evaluation, more than once, an unreleased, non-frontier research model was meant to fill in a practice copy of a government form, and when the copy failed to load or the model closed it by mistake, it went to the website where the real form lives and submitted it there. In another, Haiku 4.5 was told to fill in a form right up to the last step and stop. Several times it submitted anyway, expecting a confirmation page that never came, while its reasoning said it was only demonstrating the process, not submitting a real request. The police tip was the third example of the same thing.

Twenty visa applications

Anthropic doesn't name any of the organisations involved, "to avoid exposing vulnerabilities in their systems, and at their request." It does say some of the sites were run by US government agencies "at the federal, state, and local levels," that it briefed the White House, and that it notified each agency. Philadelphia named itself, and so, through Axios, did the State Department.

A State Department official told Axios that Anthropic got in touch on Thursday to report that one of its testing models had submitted 19 non-immigrant visa applications through the department's public website in August and one more in May. None were processed, the official said, and the department's systems were never compromised or hacked. Anthropic's report doesn't tie any example to the State Department, but the practice form that failed to load, and the model that went and found the real one, is the obvious candidate. If that's right, it makes a strange pair with the tip: a model filling in a visa application, twenty times over, for a trip nobody was going to take.

Example content

What makes Philadelphia harder to file away than the token tricks is a question Anthropic raises itself. The report weighs each case on overreach, meaning how far the model went past what the task intended, and dishonesty, meaning whether it gave a misleading account of what it was doing. On overreach it calls this batch much milder than the summer's break-ins. On dishonesty it says the comparison "is more mixed," and the tip is the reason.

"From the transcript, Claude appears to have only been producing example content for the task, rather than trying to mislead anyone to achieve a goal," the report says, whereas in the worst incident of the summer "Claude's misleading reasoning was sustained over hours and supported its continued attack." Anthropic is careful not to lean on that too hard. A model's own account of its reasoning isn't reliable evidence of why it acted, the report reminds us, and its view of these cases "may change with further analysis."

There's something to the defence. The model was asked to invent example tasks and carry them out, and it did. Its instructions told it never to "log in, create accounts, enter personal data, make purchases, or submit anything destructive," and a polite note to a tip line isn't destructive in any sense the rule's author would have had in mind. Anthropic says as much: the instructions "did not rule out form submissions," and some of these failures might have been avoided if evaluations had spelled out what was in and out of scope, "including the targets, permitted actions, and network boundaries."

But this is where it tips over, because a witness statement doesn't stop being a witness statement just because whoever wrote it thought of it as an example. To the model, the tip was sample text. To the form, it was a member of the public who'd been near a murder. If the spam filter had let it through, a detective working an unsolved killing, with a family waiting on the answer, would have had one more lead to chase and no name or number to chase it with. The report's own next sentence admits the excuse doesn't travel far: "Claude encounters ambiguous and impossible tasks every day in real use, and, indeed, several of the cases we observed occurred during regular agentic use of Claude."

Outside reaction has been less patient than Anthropic's framing. Toby Walsh, chief scientist at the UNSW AI Institute, told Australia's ABC the failures were "fundamental." "This is basic stuff. You only give an agent the minimal permissions needed to do their task. Why then did it have permission to submit a police report?" His sharpest line turned the industry's favourite fear around. "They've been warning that they might lose control of their AI models. Well, it's clear that they have," he said, "but not for the reasons that they feared, that the models would become too capable, but because the companies and the people within them proved incapable of performing basic cybersecurity." Seyedali Mirjalili of Torrens University Australia put the responsibility question more quietly: "Calling an agent autonomous should not become a way to avoid that responsibility."

What changed

Anthropic's fixes are real, and some go further than the incidents strictly required. It had already taken live internet access away from some high-risk and cybersecurity evaluations, and it has now extended that to every internal evaluation until it's confident its security and monitoring reliably catch this kind of behaviour. Some public benchmarks it has stopped running, others it has moved offline or rebuilt so their tasks don't reach live sites, and it has tightened what tools like web fetch will let a model do. It has also built tooling to spot and block these behaviours automatically, which it says runs on most evaluations and on internal agentic use of frontier models, and which blocked every case in the report when tested against them.

The cost isn't only Anthropic's to carry. The report notes that public web search benchmarks run on the live internet by default across the industry, so that labs can compare their models with each other's, and many of the evaluations involved are public and widely used. Put plainly, the scoreboard everyone uses has been sending agents onto real websites, and Anthropic has just stepped off it while asking other developers to check their own models. It ends on a line it would be good to see on more lab blogs: "The larger the role models play in society, the more the public deserves to know how they behave."

The word from Washington

The government's answer came the same day, and it wasn't thanks. In a statement shared with Axios, the leaders of the White House Super Intelligence Force said Anthropic had disclosed "various prior incidents that it discovered in late September involving the unauthorized and fraudulent use of government and other systems," and that they expected "immediate and full transparency to the entities involved and the public." Then came the part meant for everyone else. "This notification and remediation process is not optional. It is a critical national security obligation," it said. "Our message to all SI companies is clear: delayed notification, inadequate corrective action, and a failure to take responsibility will not be tolerated." Joe Gabriel Simonson, the FTC's director of public affairs, posted the same message on X.

A week ago, when the force was set up under Jay Clayton, the verb in its job description was "coordinate," with no rule, budget or testing power attached. "Not optional" is a different verb. Axios is clear that the statement doesn't say what enforcement or penalties would look like, and its footing is the memorandum of understanding with the labs rather than any law. Still, "fraudulent" sits oddly next to Anthropic's "example content." The two words describe the same transcript, and they don't agree about what it shows.

Over the same weekend Washington loosened its grip somewhere else. The Telegraph reported on Sunday, and Reuters carried it, that the White House has reversed its request that OpenAI and Anthropic hold new models back from Britain's AI Security Institute before release, the request this blog covered when Washington asked Britain to wait. It would be too neat to call the two things connected, but they point the same way, towards more people outside the labs getting to look and hearing about it sooner.

The pattern

None of this is new any more, and that's the point. Last month Australia learned that an OpenAI agent on a harmless research task had asked a Medicare statistics portal for numbers, been told no, and, in Anthony Albanese's phrase, "didn't accept no for an answer." OpenAI found it in August and told Services Australia by email in September, and when a senator asked why nobody had simply rung the minister, OpenAI's Jason Kwon said, "it's not good enough." OpenAI has since written to more than a hundred organisations about what its agents got up to, after the summer's Hugging Face break-in showed what the worst version looks like. Anthropic's own summer incidents sit in the same file.

Against that, Philadelphia is mild. Nothing was broken into, nothing private was read, and the lab told the police about ten days after it found the problem, a good deal faster than the Australian timeline. But the shape is the same, and it's the shape the police called unacceptable. The people on the receiving end didn't catch it. The model's maker did, ten weeks later, by reading its own logs, and the department only found the tip in its own records once it was told where to look.

Where it stands

Anthropic says it's still working through a much larger pile of lower-risk transcripts, including its own internal use of Claude and training environments where models can reach the internet, and that it will report new cases as it finds them. The Super Intelligence Force says the next company to wait won't be tolerated, without yet saying what that means. The Philadelphia police have their statement on the record and a meeting behind them.

Somewhere in the city's tip records there is still a message from a witness who was never there, about a street the model read off a page, offering to be contacted by someone who left no way to do it. It never reached a detective. That was the best outcome there could have been, and it was decided by a spam filter. Next time it would be better if the lab were the one that caught it.