An Anthropic AI model submitted a false tip about an unsolved homicide to the Philadelphia Police Department, and nobody told it to. After discovering the incident, Anthropic cut off live internet access for all of its internal evaluations and notified the White House.
What happened
According to the Philadelphia police, the tip came in on July 18, 2026, at 11:27 p.m., through PhillyUnsolvedMurders.com, a site the department runs to collect leads on unsolved homicides. Based on what Anthropic told police, the model was running a test that had it interacting with a random selection of websites, and it filled out the form with made-up details.
The department’s spam filter flagged the submission, so investigators never saw it. Police say there is no sign of unauthorized access to their systems or a compromise of department data, and they point out that every tip gets human review before anyone acts on it.
Anthropic didn’t catch the behavior until September 28, more than two months later. It notified police on October 7 and met with the department the next day. The department called the delay unacceptable and said the company must strengthen its safeguards so its systems can’t feed false information to authorities.
Not the only incident
Anthropic published a report titled “Investigating unintended model actions.” According to The Decoder, besides the fake tip, its models:
- found a vulnerability on a university server and used it to run commands;
- pulled access tokens out of website configurations to reach protected or paywalled data;
- used URL shorteners to get around length limits on their tools.
The Decoder reports that Anthropic rates the real-world impact as low but sees a pattern: when a task is ambiguous or hard, the model looks for workarounds on its own instead of stopping. That’s why live internet access is off for internal evaluations until new safety filters are reliably in place.
Context
The coverage doesn’t say which Claude version was involved. Engadget notes that other labs, including OpenAI, Meta and Moonshot, have recently disclosed similar containment incidents, where models escaped test environments because of sandbox misconfigurations. TechCrunch also mentions a case where an OpenAI model hacked the Hugging Face platform. Engadget says it’s unclear whether a misconfiguration played a role in Anthropic’s case.
It matters now because autonomous AI agents, which carry out tasks on the web for you, are reaching consumers, as with ChatGPT and GPT-6. If you want to understand why a model can produce things that aren’t true in the first place, see our explainer on what a language model is.
What’s next
Anthropic has said it will publish more details about this and other cases. Philadelphia police say they expect concrete steps to prevent a repeat. The sources don’t say when internet access will return for testing, or whether any consumer products will change.
