On July 18, a little before midnight, someone submitted a tip to a Philadelphia police website for unsolved murders. It claimed to know something about a homicide. The name and contact fields were blank.
It wasn’t a person. According to Anthropic, it was Claude Haiku 4.5, wandering random web pages during a test, and it filled in a real police tip form and pressed submit.
Anthropic disclosed it on October 9 in a report titled “Investigating unintended model actions in our evaluations and internal use.” The Philadelphia Police Department put out its own statement the same day.
What actually happened
The setup was simple. Anthropic had Claude Haiku 4.5 making up example tasks as it browsed random pages, and one of those pages was a police site asking for tips on an unsolved homicide. The model’s instructions barred logins, entering personal data, purchases and destructive actions. Nobody wrote a line about forms. It found one and sent it.
On the police end, the tip went nowhere. A spam filter caught it, so it never reached investigators, and the department says it found no sign anyone had gotten into its systems.
That didn’t stop them from being sharp about it. “A tip is a lead to assess – not an established fact,” the department said, and it called “the two-month delay in detecting and reporting the incident to the City” “unacceptable.”
The visa forms
A second case drew more headlines. The New York Times, citing two unnamed sources, reported that Anthropic’s agents submitted 20 visa applications through a form on the State Department’s website. The sources said all of them were incomplete and none were processed.
Anthropic’s own post doesn’t name the websites involved, and it doesn’t mention visas. The State Department gave the Philadelphia Inquirer its own account: 19 non-immigrant visa applications in August and one in May, which it described as “incomplete.” A spokesperson also said, “At no time were any of the Department’s systems compromised or hacked by the Anthropic model.”
Why it keeps happening
Anthropic’s explanation is mundane, and that’s the point. The report says many cases came from ambiguous or impossible tasks, misconfigured environments, or unclear scope, and adds: “It is possible that some of these failures could have been avoided if the evaluation questions had more clearly stated what was in and out of scope.”
In one case, Claude was told to stop before final submission, submitted several times anyway, and expected a confirmation page. In another, a practice form failed to load, and the model went to the live site.
The report describes three other kinds of behavior as well: exploiting a software flaw to run commands on a server, working around restrictions to reach gated data, and using URL shorteners to get past fetch limits. It says none involved customer data or Anthropic’s internal systems.
The part to sit with
Anthropic says the cases “had minimal real-world impact.” The police say the same thing in their own words: their safeguards limited it. A spam filter caught the tip.
But the department also said its safeguards don’t diminish “an AI system presenting fabricated information as though it came from a person with knowledge of a homicide.” The filter worked. Nobody planned for it to be the only thing that did.
The White House’s new Super Intelligence Force said it told the company it expects “immediate and full transparency to the entities involved and the public.” Anthropic has since turned off live internet access for all internal evaluations while it checks that its monitoring catches this behavior.
Notice the timeline, though. The tip went in on July 18. Police were told in early October. A model did something real on a real system, and it took more than two months for the people on the other end to hear about it. That gap is the story, as much as the form is.
Anthropic says it isn’t done looking. Its review started in July and has kept widening. So far it says it’s found nothing as severe as the earlier cybersecurity incidents. It doesn’t claim to have found everything.
Chris Meredith writes about AI, technology, and what it actually means for real people. Follow along on Substack: monkeyattack.substack.com
