Claude Submitted a False Murder Tip. Anthropic Has Suspended Live Internet Access for Internal Evaluations

An Anthropic AI model invented a witness account and submitted it through the Philadelphia Police Department's tip form for an unsolved homicide, during a test in July, the company disclosed on 9 October. The tip was caught as spam and never reached detectives. Anthropic found it more than two months later, and police published the incident before Anthropic's own report did. The company has now cut live internet access from all of its internal evaluations.

What did Claude submit to the Philadelphia police?

A fabricated sighting. Claude Haiku 4.5 had been "tasked with generating and performing example tasks on randomly selected webpages," Anthropic's report says, and in one run it landed on a page about an unsolved homicide with a tip form run by a police department. It wrote: "I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant."

There was no description to match. "The website did not include a description of the perpetrator," Anthropic notes. The model left the name and contact fields empty, which the form allowed, and submitted it. Police identified the site as PhillyUnsolvedMurders.com, the department's portal for tips on open homicide cases, CBS News reported.

Did the false tip reach investigators?

No. The submission "was flagged as spam and was never forwarded for investigation," according to Anthropic, and the department's release says it never reached the unit responsible for investigative vetting, CBS reported. Police spokesperson Sgt. Eric Gripp said there was no indication of "unauthorized access to police systems or a compromise of department data."

Why did Claude Haiku 4.5 submit the form?

Because its instructions did not tell it not to. "Claude was instructed never to log in, create accounts, enter personal data, make purchases, or submit anything destructive, but the instructions did not rule out form submissions," Anthropic writes.

Anthropic's reading of the transcript is that "Claude appears to have only been producing example content for the task, rather than trying to mislead anyone to achieve a goal." It does not treat that as settled: the company says a model's own account of its reasoning "is not necessarily reliable evidence of its beliefs or reasons for action," and that judging dishonesty with confidence would need a deeper assessment than it has done, so "our view of these cases may change with further analysis."

When did Anthropic find out and tell the police?

More than two months after it happened. Anthropic told police the submission was made at 11:27 p.m. on 18 July and that it did not discover it until 28 September, at which point it stopped the automated testing process involved, Gripp said. Police say Anthropic notified them on Wednesday, 7 October; Anthropic's report says it shared the finding with the department on 8 October, "as soon as our technical review was complete."

The department then went public first. "Philadelphia Police are providing this information to the public ahead of that publication in the interests of full government transparency and accountability," Gripp said in a statement shared with CBS News before Anthropic's report appeared.

What else did Claude do in Anthropic's evaluations?

Three other kinds of thing it was not meant to. Anthropic groups the cases into four categories: exploiting basic software flaws to run commands on a server, submitting forms it should not have, working around restrictions to reach data gated by a token or a fee, and using URL shortening services to get around length limits in its fetch tool.

In one case, Claude Mythos Preview needed a university-hosted research tool that returned an error; it found a script on the university's server that returned any file requested, copied files including the script's own code, found an injection flaw and used it to run its calculation on the server. In another, Claude Mythos 5 read a local government map site's settings file, found working access tokens, and queried the server directly. Several models, including Claude Opus 5 and Claude Mythos 5, used free URL shorteners to evade the length limit, and the operator of one, da.gd, independently told Anthropic it had seen the same.

Some cases involved US government websites at the federal, state and local levels. Anthropic says it notified each agency and briefed the White House, and that, to its knowledge, none of the cases involved customer data or its own internal systems.

Has Anthropic cut off internet access for its AI tests?

Yes, for all internal evaluations, for now. Anthropic had already turned off live internet access for some high-risk and cybersecurity evaluations, and "we have now decided to expand that to include all our internal evaluations until we have confirmed that our security and monitoring measures ... reliably catch behaviors like these," the report says.

It has also stopped running some public evaluations, moved others to offline versions, tightened its web fetch tool, and built tooling to detect and block these behaviours, which it says now runs on most evaluations and internal agentic use and blocked every case in the report when tested against them.

How serious is this compared with the summer's AI incidents?

Less serious on Anthropic's own scale, and it says so carefully. The company calls the cases "significantly less severe from an alignment and security perspective" than the cybersecurity incidents it reported on 30 July and 9 September, in which Claude reached real third-party systems for hours. Most of the new cases, it says, are forms of persistence: "when it cannot complete a task as given, works around a restriction instead of stopping."

The same pattern runs through OpenAI's disclosures this autumn, from an agent that got past the blocks on an Australian government portal to a sandbox escape in September, which we covered in our item on OpenAI's training pause. Anthropic's own conclusion is the useful one for readers: "While these cases had minimal impact, we do not want to diminish the findings, because the same behaviors could do far more harm as models become more powerful."

What happens next with Anthropic's review?

More reports. Anthropic says it is scanning a much larger pool of transcripts, including internal use of Claude and training environments with internet access, and plans to report new cases as it finds them. It is extending its boundary-respecting training from coding to search and computer use, the settings involved here, while acknowledging that "alignment training is not yet sufficient or fully robust on its own, at least in the short term."