AI provided the police station with clues about a homicide case, which turned out to be fake as expected...

Anthropic's AI submitted false tips to the police department's unsolved homicide investigation website.

At 11:27 p.m. on July 18, 2026, the Philly Police Unsolved Murders website of the Philadelphia Police Department in the United States received a new tip. The website features a series of real case details and victim profiles, where visitors can anonymously submit text and upload photos. If the tip helps crack the case and leads to a conviction, the submitter can receive a maximum reward of 20,000 US dollars. [1][2]

Each "Case Details" page contains detailed descriptions and allows submission of text or photos 丨 Philly Police Unsolved Murders

That late night, the person filling out the form was not a human who witnessed the homicide, but Claude Haiku 4.5, which was under testing by Anthropic. It was instructed to generate and execute example tasks on randomly selected web pages on its own.

After landing on the page of an unsolved homicide case, it opened the entrance for tip submission and wrote a paragraph that looked very much like a real person recalling the crime scene:

I may have some information about this case. I remember seeing a person matching the description near a certain street around the time the incident happened. Please contact me if this information is useful.

It did not leave a name or contact information, and sent out the fabricated tip with one click. [3]

This false tip lay in the records for more than two months. Anthropic did not discover until September 28 that Claude Haiku 4.5 had done such a misdeed, and then stopped the automated test that caused this submission. However, the Philadelphia Police Department was not notified of the incident until October 7; the two sides met on October 8, and the police first disclosed the incident to the public on October 9. [4]

Fortunately, the false tip did not turn into a real investigation. By a twist of fate, the notification email of "new tip" fell into the spam folder and was never opened by a human. The police did not disclose why the email was marked as spam, and stated that even if the false tip entered the normal process later, it would still be reviewed by humans to find supporting evidence, and would not be directly adopted as a fact. [5]

The Philadelphia Police Department explicitly criticized that it took more than two months from the occurrence of the incident to its discovery and notification, which is "unacceptable".

This is certainly not the only case where the model "spontaneously came up with an unexpected idea"

What is disturbing (but perhaps everyone has been accustomed to it) is that the false tip is not the only accident in the report. These incidents can be roughly divided into two categories.

The first category: the normal path is blocked, and the model finds another way out.

Some tools of Anthropic do not allow access to overly long URLs, because long URLs may contain commands that load attack sites. Claude sent the long URL to a free short URL service, used it to pass the check, and then redirected to the long URL [3].

The short URL service da.gd found that the Claude test model was using their service without permission.

Well, it's like you stuff all the extra items into your vest to bypass the baggage weight check of a low-cost airline, then take them out and put them back into your luggage after boarding the plane.

Sometimes I don't know whether to praise it for its perseverance. Claude needed to use a tool on a university website to complete scientific calculations, but the tool reported an error. It did not give up, instead it parsed the server code, found a loophole in the code, and used the loophole to complete the calculation.

In another test, Claude Mythos 5 was asked to judge the shooting location based on a photo. The model planned to query the local government's property map to narrow down the scope step by step, but the test tool restricted it from continuously clicking on web pages. So it bypassed the web interface and directly requested data from the map's backend server. It also once managed to bypass the payment entrance to obtain public data that originally required payment.

The trouble is that it cannot always distinguish between a problem to be solved and a boundary that must not be crossed without permission.

The second category: it does not realize that "it is time to stop now".

In one test, Claude Haiku 4.5 was given a clear requirement: it could fill out the form, but must not submit it. However, it pressed the submit button several times, because it thought there would be a confirmation page later. [3] The false tip received by the Philadelphia Police also falls into this category.

An AI can find its own way, but it does not know where it should stop, let alone what real-world consequences its actions will cause. This is a big problem that cannot be solved in a short period of time.

Anthropic believes that the cases disclosed this time are less severe than the cybersecurity incidents in summer 丨 Anthropic official website

Anthropic currently believes that the actual impact of the cases found so far is limited, and no customer data has been affected as a result. The company has suspended real-time internet access for internal evaluations and increased monitoring of abnormal operations.

CEO Dario Amodei has been calling for a slowdown in the pace of artificial intelligence development so that laboratories can establish complete protective measures.

But why did you let a new model without human supervision operate real websites on its own? [6]

References

[1] Philadelphia Police Department. Philly Police Unsolved Murders. Philly Police Unsolved Murders.https://www.phillyunsolvedmurders.com/.

[2] Philadelphia Police Department. Submit a Tip Online. Philly Police Unsolved Murders. No date, accessed on October 10, 2026. https://www.phillyunsolvedmurders.com/forms/submit-a-tip-online/.

[3] Anthropic. Investigating unintended model actions in our evaluations and internal use. Anthropic. October 9, 2026. https://www.anthropic.com/research/investigating-unintended-model-actions.

[4] David Chang. Anthropic AI model submits false tip on unsolved Philly murder, police say. NBC10 Philadelphia. October 9, 2026. https://www.nbcphiladelphia.com/news/local/anthropic-ai-model-submits-false-tip-on-unsolved-philly-murder-police-say/4477051/.

[5] Mary Cunningham. Philadelphia police say their unsolved murder website received “false homicide tip” from Anthropic AI. CBS News. October 9, 2026. https://www.cbsnews.com/news/philadelphia-police-anthropic-ai-false-homicide-tip/.

[6] Amanda Silberling. An Anthropic AI model sent a false homicide tip to Philadelphia police. TechCrunch. October 9, 2026. https://techcrunch.com/2026/10/09/an-anthropic-ai-model-sent-a-false-homicide-tip-to-philadelphia-police/.

[8] Costas Pitas. Anthropic AI model submits false homicide tip to Philadelphia police website. Reuters. October 9, 2026. Full text republished by KSL.

This article is from the WeChat official account "Guokr" (ID: Guokr42), written by Luna, and is published with authorization from 36Kr.