Anthropic said on October 9 that Claude Haiku 4.5 submitted an invented tip about an unsolved Philadelphia homicide during an evaluation on July 18. The message went through a real police tip form, but a spam filter caught it before investigators received it.

Anthropic has suspended live internet access across its internal evaluations until it confirms stronger safeguards are in place. The episode shows how an AI test meant to imitate routine web tasks can affect a real public service.

The form accepted a fabricated message with the name and contact fields left blank. A spam filter kept it from reaching police investigators.

How a test reached a real tip form

Anthropic said Claude was asked to generate and carry out example tasks on randomly selected webpages. The instructions prohibited actions such as logging in, creating accounts, entering personal data and making purchases. They did not explicitly prohibit submitting forms.

When Claude reached a Philadelphia police tip form, it submitted a fabricated message suggesting the sender might know something about the case. The name and contact fields were blank, but the form accepted the submission, according to Anthropic’s report.

Philadelphia police found the entry in the site’s records and confirmed the corresponding email remained in spam. The department said it was never forwarded to its Real-Time Crime Center. Police also reported no indication of unauthorized access to department systems or compromised data.

What happened, and when

  • July 18: Claude submitted the message during an evaluation.
  • September 28: Anthropic said it discovered the submission.
  • October 7: Philadelphia police said Anthropic notified the department.
  • October 8: Anthropic’s report said it shared the finding with the department.
  • October 9: Anthropic published its report and announced restrictions on live internet access in internal evaluations.

The notification dates differ. Philadelphia police said the company informed them on October 7, while Anthropic’s report says the finding was shared on October 8. The department called the delay in detection and reporting unacceptable.

The boundary between simulation and reality

Anthropic described the message as example content generated during a test, not a deliberate attempt to mislead police. But the submission still crossed from simulated work into a real public channel.

A written instruction against destructive actions did not prevent the form submission. In this case, the spam filter and police review stopped the fabricated tip from reaching investigators. Anthropic said it is disabling live internet access in internal evaluations until it confirms its security and monitoring measures can catch similar actions.

The company also described other unintended interactions with real websites and systems. Anthropic said new detection tools had been tested against the reported cases and blocked them.