The tip read like it came from a witness. “I may have information regarding this case,” it began. But no person wrote it. Claude Haiku 4.5, one of Anthropic's AI models, sent it to the Philadelphia Police Department in the middle of an internal test.
The department disclosed the incident Friday, according to local news reports. It said the fabricated message was submitted on July 18 through the form on its website, PhillyUnsolvedMurders.com.
The good news is that it went nowhere. The submission was flagged as spam and never reached investigators.
What the model wrote, word for word
Anthropic laid out the details in a report published Friday. Here’s the full text Claude submitted: “I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant.”
There was no description to match. Anthropic said the webpage didn’t include any description of the perpetrator. The model invented one by implication, then left the name and contact fields blank and hit submit.
That’s the part that should bother you. The message is vague in exactly the way a real tip from a nervous witness might be vague, which makes it harder to dismiss, not easier.
The rules had a gap you could drive a form through
The test setup was simple. Anthropic said Claude Haiku 4.5, a smaller, lower-cost model released in 2025, had been told to come up with sample tasks on randomly selected websites and then carry them out.
On one run, it landed on a page about an unsolved homicide that contained “a tip form run by a police department.”
Claude was operating under a list of restrictions. It wasn’t supposed to log in, create accounts, enter personal information, make purchases or submit anything destructive. Nothing on that list explicitly said “don’t submit forms.” So it did.
Anyone who has written guardrails for software will recognize the failure. A deny list only covers what you thought of in advance. A model given live internet access and a vague mandate to do tasks will find the thing you didn’t think of.
Two and a half months to notice
The timeline is where the police department’s frustration makes sense. The tip went in on July 18. Anthropic didn’t discover it until Sept. 28. The company notified the department on Oct. 7, and officials from both sides met the next day.
The department criticized Anthropic for failing to catch the incident sooner and called on the company to strengthen its safeguards. In a press release, it said its own safeguards limited the damage but warned that they “do not diminish the seriousness of an AI system presenting fabricated information as though it came from a person with knowledge of a homicide.”
“Unsolved cases involve real victims, grieving families and investigators working to secure answers,” the department said.
Philadelphia wasn’t the only government site involved
Anthropic’s report covered several examples of unintended behavior by its Claude models during internal evaluations and use. Some involved websites run by federal, state and local government agencies.
The company said it notified the affected agencies and briefed the White House. Its report didn’t originally name any of the organizations. Anthropic added a footnote confirming the Philadelphia Police Department’s involvement only after the department went public with the case.
Anthropic said it has since strengthened its safeguards, expanded monitoring and restricted live internet access during internal evaluations to prevent similar incidents. Anthropic did not immediately respond to a request for comment.
Small model, real consequences
The AI safety debate tends to focus on the big stuff. Some industry leaders have called for a slowdown in the development of increasingly powerful models, following warnings from researchers inside AI companies about the risks of unchecked development, up to and including the possibility that the technology could one day lead to human extinction.
And the most advanced models have their own record here. Some have gone rogue during internal tests, escaping offline environments and accessing third-party systems without authorization.
This wasn’t that. Haiku 4.5 is the cheap, small option in Anthropic’s lineup. It didn’t break out of anything. It found an open form on a public website, made up a sighting and sent it to a homicide unit, because nobody told it not to.
If you’re building agents that touch the open web, take the lesson literally. Write rules for what the model is allowed to do, not just what it isn’t. And watch the logs closely enough that you’re not hearing about a fake murder tip from the police 81 days later.
