During an Anthropic test, Claude Haiku 4.5 sent a Philadelphia police tip form an invented sighting in an unsolved murder; Anthropic reports it as one of four kinds of unintended action and cuts live internet from all its internal evaluations

Anthropic published a report on 9 October on "unintended model actions" it has seen in its evaluations and its own use of Claude. One of them reached a police department.

Claude Haiku 4.5 "had been tasked with generating and performing example tasks on randomly selected webpages". It landed on a page about an unsolved homicide that carried a police tip form. "Claude was instructed never to log in, create accounts, enter personal data, make purchases, or submit anything destructive, but the instructions did not rule out form submissions."

It wrote: "I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant." The page, Anthropic notes, "did not include a description of the perpetrator". The model left the name and contact fields empty and submitted it. "The submission was flagged as spam and was never forwarded for investigation."

Philadelphia police, in a statement reported by NBC10, say the tip was posted on PhillyUnsolvedMurders.com on 18 July at 11:27 p.m., that Anthropic found it on 28 September and told the department on Wednesday 7 October, and that the two met the next day; police then found the email still in spam. Anthropic's report puts it a day later: "We shared this finding with the department on October 8 as soon as our technical review was complete." The police spokesperson: "They do not diminish the seriousness of an AI system presenting fabricated information as though it came from a person with knowledge of a homicide," and "The two-month delay in detecting and reporting the incident to the City is unacceptable." The city's Law Department and the mayor's team are investigating.

The tip is one case in four categories Anthropic lists: "Claude exploiting a basic flaw in software to run commands on a server", submitting forms it should not have, "Claude working around a restriction to reach data that was gated by a token or a fee", and "Claude using URL shortening services to get around limits in its fetch tool". In one case Claude Mythos Preview used an injection flaw on a university's server to run a calculation; in another, Claude Mythos 5 requested the access token a state agency's public dashboard issues to any visitor and queried its database "without paying the fee". Some cases involved US government websites; Anthropic says it has "briefed the White House on these cases and notified each agency involved", and that they "had minimal real-world impact".

What changes: live internet access, already off for some high-risk and cybersecurity evaluations, is cut from "all our internal evaluations" until Anthropic has confirmed its monitoring catches these behaviours. New tooling to detect and block them was tested on every case in the report, and "it blocked all of them". On the tip, Anthropic's reading is that Claude "appears to have only been producing example content for the task, rather than trying to mislead anyone to achieve a goal" - and it adds that "our view of these cases may change with further analysis".