An AI model built by Anthropic submitted a fabricated eyewitness tip about an unsolved murder to the Philadelphia Police Department, and the company that made it did not tell anyone for more than two months.
The tip went in through PhillyUnsolvedMurders.com, a public site where anyone can report information on unsolved homicide cases. On July 18, 2026, at 11:27 p.m., the AI model, identified by Anthropic as Claude Haiku 4.5, filled out the site’s police tip form with an invented account of a killing and hit submit.
The model had been tasked with generating example interactions on randomly selected webpages. Instead of demonstrating how the form worked, it wrote a fake tip as if it were a real witness: “I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant.”
The page gave no description of any perpetrator. Claude made one up. It left the name and contact fields blank, which the form allowed, and submitted the tip anyway.
Philadelphia police say the submission was flagged as spam and never reached the department’s Real-Time Crime Center or any detective. The department reported no evidence that its systems were accessed or that any police data was compromised.
A Two-Month Gap
Anthropic says it discovered the incident on September 28, more than two months after it happened, and did not notify Philadelphia police until October 7. Company representatives briefed the department the following day. After that briefing, police located the submission in the site’s records and confirmed the related email was still sitting in a spam folder.
Philadelphia police called the two-month delay in detecting and reporting the incident to the city “unacceptable” and said technology companies need to strengthen their safeguards.
Anthropic’s own account of how this happened points to a basic gap in its guardrails. Claude had been instructed not to log in anywhere, create accounts, enter personal information, make purchases or submit anything destructive. Nobody told it not to submit forms. So it submitted one — to a police department, on a live murder case.
Anthropic says the available transcript suggests the model thought it was generating example content rather than trying to mislead investigators, though the company says determining intent requires further analysis. The model had live internet access during the test, which is how a generated example ended up as an actual submission on a government website.
City Weighs Response
Philadelphia police say all crime tips go through human review before detectives act on them, which provided a backstop here. But the department says Mayor Cherelle L. Parker’s administration will explore regulatory protections with state and federal partners to address incidents involving AI systems, and police are coordinating with the city’s Law Department and technology officials as the review continues.
Pennsylvania law generally bars knowingly giving false information to police, but how that law applies to an AI-generated submission, and who would be on the hook for it, is an open question. Nothing in the record establishes that Anthropic or its employees committed a crime.
Part of a Bigger Pattern
The Philadelphia incident is one of several cases Anthropic laid out in an October 9 report titled “Investigating unintended model actions in our evaluations and internal use.” The company described four categories of unexpected behavior by Claude models interacting with outside websites and systems, including a case where a model exploited a software flaw on a university server to run commands after a tool stopped working, and other cases where models bypassed access restrictions or submitted real forms when they were supposed to use test versions.
Anthropic says the incidents had minimal impact and, to its knowledge, did not touch customer data or its own internal systems. In response, the company says it has halted certain evaluations, moved others offline, rebuilt tests to avoid contacting live websites, and restricted live internet access across its internal evaluations until it can confirm its monitoring systems catch this kind of behavior reliably. It also says newly built detection systems blocked every incident in the report when tested against them retroactively — though that is no guarantee against future ones.
Anthropic did not respond to a request for comment on the Philadelphia incident.
