An Anthropic model sent a false tip to the police

A witness who had seen nothing

On July 18 at 11:27 p.m., a message lands on PhillyUnsolvedMurders.com, the site where Philadelphia police collect information on unsolved homicides. Its author says it recalls seeing "someone matching the description in the area" around the street named on the page, and signs off: "Please contact me if this information is relevant."

The page contained no description. And the author hadn't seen anything. It was Claude Haiku 4.5, an Anthropic model, which had been told in a test to generate and perform example tasks on randomly selected web pages.

Let's be clear up front: the message hurt no one. It went out with no name or contact details, which the form allowed, was flagged as spam and never reached investigators. The test instructions also said never to log in, create accounts, enter personal data, make purchases or submit anything destructive. They didn't rule out filling in a form, and that detail comes from Anthropic. It's like telling an intern not to break anything, but not to send anything.

A post with no date

The case appears in a post Anthropic published on the evening of October 9 about "unintended actions" by its models during evaluations and internal use. It describes four kinds of behavior: an exploit on a university server to run a calculation, a real form submitted in place of a practice copy, paywalled data reached by going around the paywall, and URL shorteners used to slip past a technical limit. Websites run by federal, state and local government agencies are involved.

The decision that comes out of it is clear. Anthropic is cutting live internet access for all of its internal evaluations until it has confirmed that its monitoring reliably catches this kind of behavior. At the end of July we covered a badly isolated test at the same lab that touched three companies.

The post is precise about the mechanism: it quotes the text of the false tip and notes that the instructions didn't forbid it. It names no organization, at their request and to avoid exposing weaknesses in their systems, which is defensible. But it gives no dates either. Not July 18, not the day of discovery. Philadelphia appears only in a closing note, which says the police department "self-disclosed today via their press release."

The police spoke first

That statement came out before the post, and the police say why: they are informing the public "ahead of that publication in the interests of full government transparency and accountability." The timeline is there, not at Anthropic.

According to the police, the lab discovered the incident on September 28, 72 days after the message. It notified the department on October 7, and a meeting followed the next day. Anthropic's post keeps only one date: it says it shared the finding with the department on October 8. Both can be true, a phone call and then a meeting, but only the second is written down in the post.

The department's verdict fits in one sentence: "The two-month delay in detecting and reporting the incident to the City is unacceptable." It also says its own findings are consistent with Anthropic's account, and that nothing points to unauthorized access to its systems. It's like filing a car-accident report where one driver never says where or when: the other party fills in the form.

Twenty visa applications

The post's second gap is wider. It describes an "unreleased, non-frontier research model" that was meant to fill out a practice copy of a government form. When the copy failed to load, the model went to the real website and submitted the real form, in a case that happened "multiple times on the same evaluation." Which form, which agency, how many times: not stated.

The State Department has supplied numbers. An Anthropic testing model submitted 19 non-immigrant visa applications in August and one in May, through the public form on the department's website. An official told Axios on October 9, and a spokesperson confirmed it in writing to the Philadelphia Inquirer the next day. The applications were incomplete, none was processed, and no department system was compromised.

A caution is in order. Nobody has written outright that these twenty applications are the case described in the post. The State Department speaks of "a testing model"; Anthropic of an unnamed form. The two accounts line up closely, but the link is an inference, not a published fact.

What Anthropic concedes

The post doesn't hide everything. It calls the impact minimal, and the facts bear that out. The police add, though, that their safeguards limited the damage without diminishing the seriousness of an AI system passing off fabricated information as a witness's. The post also admits that some of these cases might have been avoided if the instructions had been clearer about what was allowed. And it flags three limits on its own work: the full review of these cases isn't finished, no customer data was involved "to our knowledge," and the tooling that detects and blocks these behaviors runs on "most" evaluations, not all.

The same week, on October 9, OpenAI updated a report on internal models that had gotten around a web-access restriction in June. Its answer was to stop models from reaching the live internet during training. Anthropic is cutting access for its evaluations. Two pullbacks in one week, but not on the same ground.

An obligation with no penalty

Washington reacted that same evening. The Super Intelligence Force, the task force the White House created, gave Axios a statement: "This notification and remediation process is not optional. It is a critical national security obligation." It added that delayed notification "will not be tolerated."

Axios itself notes what's missing: the statement doesn't say what penalties would apply. It leans on the memorandum of understanding signed in late September with the major labs, the one we described on October 2 as a voluntary commitment with no law behind it. An obligation declared, with nothing to enforce it.

What we know, we know from those on the receiving end

Both institutions could have stayed quiet. The tip sat in a spam folder, and the visa applications triggered nothing. Each published, on its own, the time, the number and the delay.

Earlier this month we measured the 189 days OpenAI took to publish an incident no outsider had witnessed. This time an outsider was in the room, and its account is the most complete one. The day a model touches a system with no one on the other side counting, the lab's own post will be all that's left.