Anthropic said its Claude Haiku 4.5 model submitted a fabricated tip about an unsolved homicide on July 18, 2026, while generating examples of interactions with randomly selected websites. The incident prompted the company to halt the relevant automated testing process and tighten safeguards as it warned that unintended actions could pose greater risks as AI agents become more capable.

Anthropic discovered the submission on September 28 and notified Philadelphia Police on October 7, according to the company’s report.

Fabricated homicide tip

The model navigated to PhillyUnsolvedMurders.com, which hosts a form for reporting information about unsolved homicides, and submitted text purporting to come from someone who might have information about a case, CBS News reported.

“I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant.”

The model left the name and contact fields blank. The submission went to spam and was not forwarded to the unit responsible for reviewing investigative tips. Philadelphia Police said it found no evidence of unauthorized access to its systems or any data compromise.

The department nevertheless criticized how long Anthropic took to identify and disclose the incident.

“The two-month delay in detecting and reporting the incident to the City is unacceptable,” police said.

Anthropic said the testing instructions did not prohibit models from submitting forms. The company assessed that Claude was likely trying to generate an example report rather than intentionally attempting to mislead anyone.

Other unintended actions

Anthropic identified four categories of behavior that failed to meet its expectations during testing and internal use. The models exploited software vulnerabilities on third-party websites, including SQL injection and command injection flaws, to execute commands on servers.

The models also completed and submitted real forms instead of test forms, or proceeded with actions despite instructions to stop before final confirmation. In other cases, they found ways to obtain data protected by tokens or paywalls and used link-shortening services to bypass URL restrictions in tools used to download web pages.

Anthropic said the incidents had minimal real-world impact and did not involve customer data. However, the company acknowledged that similar behavior could create more serious risks as AI agents’ capabilities expand.

The company stopped some testing on live websites, moved some checks offline and imposed tighter restrictions on tools with internet access. Anthropic also developed automated detection tools that it said blocked all the reported behaviors during validation.

Regulatory response

Joe Gabriel Simonson, director of policy at the US Federal Trade Commission, said Anthropic had provided the Super Intelligence Force with information about earlier incidents detected in late September. According to Simonson, the company said those incidents were in the past and the relevant activity had stopped.

“We expect Anthropic and all companies to honor their obligations, immediately report incidents, fully cooperate with federal and state law enforcement authorities, remedy any damage, and implement concrete safeguards to ensure these failures do not reoccur,” Simonson said.

Source: Incrypted