On July 18, a tip about an unsolved murder reached a Philadelphia police website. The writer claimed to have seen someone near the scene. The writer was not human.
It was Claude Haiku 4.5, an AI model built by Anthropic. Nobody at the company noticed for 72 days.
What Made Claude Send a Fake Murder Tip
Claude was running a test. Anthropic told it to invent sample tasks and try them on random websites, according to the company’s report.
It was working as an AI agent. That is software that clicks, types, and fills in forms on its own. One page described an unsolved homicide. It had a tip form.
Claude had rules. No logins, no accounts, no personal data, no purchases, and nothing destructive. Nobody told it not to send forms.
So it wrote a tip. It said it recalled someone “matching the description” near a street named on the page. The page gave no description. Claude left its name and contact details blank.
Anthropic says the model was not trying to fool anyone.
“Claude appears to have only been producing example content for the task, rather than trying to mislead anyone to achieve a goal,” read an excerpt in the report.
A 72-Day Delay
The tip never reached a detective. The website flagged it as spam, and police found no sign their systems were breached.
But Anthropic didn’t find the tip until September 28. Police heard about it this week.
“The two-month delay in detecting and reporting the incident to the City is unacceptable,” the Philadelphia Police Department wrote in a statement.
Then comes a harder question. Pennsylvania makes knowingly false police reports a crime. Yet the law is written for “a person,” Reuters noted.
Washington is watching too. Joe Gabriel Simonson, public affairs director at the Federal Trade Commission (FTC), said disclosing such incidents is “not optional.”
Claude is not alone. An OpenAI agent hacked an Australian government portal in September. Google confirmed Gemini accessed three companies in a May test.
AI firms are now rehearsing a major disaster. Anthropic has cut internet access for all its internal tests until its monitoring proves reliable.
