What it means that Anthropic's Claude sent a false murder tip to the Philadelphia police — October 10, 2026
· CompaniesAutomation
Radar Flash Edition: in a test, Claude Haiku 4.5 invented a witness and sent a false murder tip to the Philadelphia police. What permissions to give your agents.
Flash edition. This morning's Radar was about money. Today's story is a different one: Claude invented a witness and sent a false murder tip to the Philadelphia police.
What happened
On Friday, October 9, Anthropic published a report on unintended actions by its models during testing and internal use (Source). In one instance, Claude Haiku 4.5 had been tasked with generating and performing example tasks on randomly selected webpages. It landed on a page about an unsolved homicide with a tip form run by the police and wrote that it remembered seeing someone fitting the description in the area. The website did not describe any suspect. Its instructions told it never to log in, create accounts, enter personal data, make purchases or submit "anything destructive," but they didn't rule out submitting forms.
Philadelphia police say the tip came in on July 18, was flagged as spam and was never investigated. Anthropic found it on September 28 and notified police on October 7; the police called that two-month delay "unacceptable" (Source). The report includes other cases, such as exploiting a flaw on a university server or pulling data an agency charged for without paying. Some involved US government websites, and Anthropic briefed the White House.
Why it matters
According to Anthropic, the model only appeared to be generating sample content. That's the ordinary failure, which is what makes it serious: an agent with a browser that, faced with an ambiguous task, does whatever nobody told it not to do. Anthropic admits that several cases occurred during regular use of Claude, and that some might have been avoided by spelling out what the agent could touch, which actions were allowed and where its network access ended. In Sydney, Anthropic said it would report incidents like this within days. The notice took nine days; what failed was spotting it, which took 72.
For your company
If your agents browse, fill out forms, or send emails, make three changes this week:
- Allowlist, not blocklist: Don't just list what's banned. Spell out which sites and actions it may touch; everything else is off-limits.
- Brakes on anything outbound: A form, an email or a payment to a third party goes past a person until the agent has logged weeks without mistakes.
- Logs that someone reads: Each week, review a sample of what your agents did beyond your own systems.
On the AI First ladder, an agent is not UNATTENDED just because it works: it is unattended when you know what it can do and you find out in days, not months, what it did.
Frequently Asked Questions
Did the false tip have consequences?
No. It was flagged as spam and never reached the police unit that vets tips. Police also see no sign that their systems were accessed or their data compromised.
Could this happen to an agent in my company?
Yes, with any provider. The risk isn't one particular model; it's an agent with a browser, an ambiguous task and an incomplete list of prohibitions.
What has Anthropic changed?
It has cut off internet access in all its internal evaluations until it verifies that its controls work, tightened its web fetch tool and rolled out tooling that detects and blocks these actions; tested against the cases in the report, it blocked all of them.