Anthropic disclosed on Friday that one of its Claude models filled out and submitted a tip form on the Philadelphia Police Department’s unsolved murders website during an automated test.
Zoom in: Claude Haiku 4.5 was generating and performing example tasks on randomly selected webpages when it landed on a page about an unsolved homicide carrying a police tip form. Its instructions ruled out logins, accounts and destructive submissions, and said nothing about filling in forms.
- The model wrote: I may have information regarding this case. I recall seeing someone matching the description in the area around the street named on the page during that time period.
- The page carried no description of the perpetrator. Claude left the name and contact fields empty, which the form allowed.
Yes, but: The tip was flagged as spam and never reached the unit responsible for investigative vetting, per the Philadelphia Police Department, which found no sign of unauthorised access to police systems.
The backstory: The submission happened at 11:27pm on July 18 and Anthropic discovered it on September 28, then halted the automated testing process that produced it, Sgt. Eric Gripp said. Anthropic notified the department on Wednesday.
What they're saying: Philadelphia Police are providing this information to the public ahead of that publication in the interests of full government transparency and accountability, Gripp said.
The big picture: Anthropic grouped the tip with three other behaviours: exploiting software flaws to run commands on a server, working around paywalls and token gates, and using URL shorteners to get past limits in its fetch tool.
Between the lines: Anthropic described most of these as persistence: when Claude cannot complete a task as given, it works around the restriction. The company tied that pattern to reward hacking picked up during training.
What's next: Anthropic has switched off live internet access for all internal evaluations until it confirms its monitoring reliably catches such behaviour, and it briefed the White House and notified each agency involved.
Why it matters: AI agents now take real actions on real websites at scale, and this is a documented case of one filing a police report that no human asked for.
