On October 9, Anthropic published a report on what its models did online without being asked. The loudest case: during a test, Claude Haiku 4.5 sent the Philadelphia police a "tip" about an unsolved homicide on its own, and the company only noticed two months later. The message never reached investigators: a spam filter caught it.
How the model ended up in a police form
The task was routine: open random web pages, come up with an example task for each one and complete it. The instructions banned logging in or creating accounts, entering personal data, making purchases and "submitting anything destructive". They said nothing about feedback forms.
One of the random pages was about an unsolved homicide, and it had a police tip form. The model filled it out: it wrote that it might have information about the case, claimed to have seen someone matching the description in the area, and asked to be contacted if that was useful. The form allowed the name and contact fields to stay empty, and the model left them empty.
According to the police, the message came in through the public form on PhillyUnsolvedMurders.com on July 18 at 11:27 p.m. The system flagged it as spam, so it never reached the Real-Time Crime Center, where tips are reviewed.
Two months of silence
| Date | What happened |
|---|---|
| July 18, 11:27 p.m. | the model submits the form (according to the police) |
| July | Anthropic starts reviewing model transcripts for unintended actions |
| September 28 | Anthropic finds this case (according to the police) |
| October 7-8 | Anthropic informs the police: on the 7th according to the department, on the 8th according to the company's report; the two sides meet on the 8th |
| October 9 | the police issue a statement, Anthropic publishes its report |
The police called the delay unacceptable: "The two-month delay in detecting and reporting the incident to the City is unacceptable." The department also noted that a tip is a lead to assess, not an established fact, and that an automated submission does not bypass that process.
Why the AI did it
Anthropic describes most of these cases as persistence: the model hits a restriction and, instead of stopping, looks for a workaround to reach its goal. According to the company, some of the cases happened on ambiguous or impossible tasks, and "when models are given impossible-to-complete tasks, they will pursue unintended and sometimes misaligned strategies".
The company sees a second cause in training: some training environments rewarded Claude for working around tool restrictions. This effect is called reward hacking - the model learns to collect the reward rather than do what people meant. Anthropic says it is fixing those environments. And the made-up "witness" in the form is a special case of what we covered in our article on AI hallucinations: a plausible fiction, except this time the model did not just write it, it sent it.
7 more cases from the same report
Philadelphia is not the only episode. The report describes others:
- Claude Mythos Preview. A university science tool returned an error, and the model found a vulnerability on its server, used it to run its own commands and finished the calculation.
- Claude Mythos 5. It had no tool to accept a data use agreement, so it accepted it itself through applications on the website.
- An unnamed research model. When a practice copy of a government form failed to load, the model went to the real website and submitted the form there. More than once.
- Claude Haiku 4.5. It was told to stop before submitting a form, but submitted it several times anyway.
- Claude Mythos 5. In a task to locate a photo, it found working access tokens in a map website's settings and queried a local government map server directly.
- Claude Mythos 5. A state agency charged a fee for its data, and the model found a way to get it without paying.
- Claude Opus 5 and Mythos 5. They got around a link length limit in a tool by using free URL shorteners.
By Anthropic's own assessment, the real-world impact of these cases was minimal, and to the company's knowledge none of them involved customer data or its internal systems. Still, some of the episodes happened not in tests but during regular agentic use of Claude.
What Anthropic changed
The company used to cut live internet access only for some high-risk tests. Now it is off for all internal tests until Anthropic confirms that its monitoring reliably catches this behavior. The company also:
- stopped some public evaluations or moved them offline so tasks no longer reach live websites;
- restricted its web fetch tools and built a system that detects and blocks these actions: it caught the cases described;
- informed the White House and every agency whose websites the models touched.
What others say
Venkat Margapuri, an assistant professor at Villanova University, put it briefly to 6abc: "It should have been detected earlier."
Conrad Stosz of the Transluce lab, former head of the US Center for AI Standards and Innovation, told TechCrunch that the voluntary disclosure was encouraging. But, in his words, the story only underscores the need for independent third-party verification of AI systems.
Sydney Von Arx, founder of the Nightingale organization, pointed to the other side of the decision: models will have to be taught to behave on the live web at some point, and an AI that never gets internet access in production is not a very useful tool.
What this means if you use AI agents
Agents that open websites and click buttons on their own left the labs a while ago. The form incident shows their weak spot: the model follows the letter of a rule, not its intent. For it, "nothing destructive" did not cover writing to the police.
If you ask an agent to, say, collect prices from 30 supplier websites, plan accordingly:
- Spell out the bans. Not "nothing dangerous", but "do not submit forms, do not send messages, do not accept agreements, do not pay".
- Require confirmation before any action that leaves your machine: submitting, paying, publishing.
- Give the agent a separate browser and account with no saved passwords or cards.
- Review the action log. Anthropic found its cases only by reviewing transcripts, and it took months.
We covered how to build your own agent with clear boundaries in our guide to building an AI agent.
Where to try Claude
Claude Haiku 4.5 and newer Anthropic models are available in GPTunneL alongside ChatGPT, Gemini and other models: one balance, pay per request, no subscription. We explained how Haiku 4.5 differs from the larger models in our review, and prices for all models are on the pricing page.