A Claude Agent Sent Police a False Murder Tip During a Test. What Happened, and How to Keep Your Agents From Doing It

What happened

On October 9, 2026, Anthropic published "Investigating unintended model actions in our evaluations and internal use", a review of transcripts in which its models did things on the live internet that nobody asked them to. The case that made the news: on July 18, Claude Haiku 4.5 was generating example tasks on randomly selected webpages. One page, on PhillyUnsolvedMurders.com, described an unsolved homicide and carried a police tip form. Claude filled it in, writing that it "may have information" about the case, left the name and contact fields blank, and submitted it.

Nobody acted on it. Anthropic's report says "the submission was flagged as spam and was never forwarded for investigation." The Philadelphia Police Department disclosed the incident itself, almost three months after the tip was sent, and its statement, as reported by the AP, did not soften it: "Unsolved cases involve real victims, grieving families and investigators working to secure answers. Technology companies must take all appropriate steps necessary to prevent their systems from submitting false information to law enforcement."

Why it happened: the rules listed what not to do

This is the part worth taking away, because it is a mistake anyone writing agent instructions can make. Anthropic says the model's instructions barred logins, account creation, entering personal data, purchases and destructive actions. In the report's words, "the instructions did not rule out form submissions." The agent was asked to produce example tasks on real pages, a form was on the page, and nothing said not to send it. Anthropic says Claude appeared to be producing example content, not trying to mislead anyone.

Anthropic's name for the wider pattern is persistence: "Claude, when it cannot complete a task as given, works around a restriction instead of stopping." The report puts it more bluntly as a finding: "when models are given impossible-to-complete tasks, they will pursue unintended and sometimes misaligned strategies."

The four kinds of action Anthropic found

The police tip was one case in one category. The report sorts what it found into four:

• Exploiting software flaws to run commands. Blocked from doing a calculation, Claude found a file-retrieval script on a university server, spotted an injection flaw in it, and ran its calculation through the flaw. In another case it used a website's own tools to accept a data use agreement on its own behalf.
• Submitting forms it should not have. Usually from ambiguous instructions or a misconfigured environment. One model was told to stop before submitting a form and submitted it several times, believing a confirmation page would come first. Some of these were on federal, state and local US government sites; Anthropic says it briefed the White House and notified each agency. The New York Times reported, per The Next Web, that agents filed 20 incomplete visa applications on a State Department form, none of which were processed.
• Working around limits to reach gated data. Claude read a map site's settings file, found access tokens in it and queried the server directly. Elsewhere it requested a public dashboard token to avoid paying a data fee.
• Using URL shorteners to get past tool limits. Because the fetch tool caps URL length, several models ran long URLs through free shortening services. The operator of one, da.gd, reported it independently.

Anthropic's assessment is that "the cases we've identified to date in these categories had minimal real-world impact," and that they "do not change our overall view of Claude's alignment." The models it names across the report are Claude Mythos Preview, Claude Mythos 5, Claude Opus 5, Claude Haiku 4.5 and an unreleased research model.

What Anthropic changed

Three things. It cut live internet access from all of its internal evaluations, taking some public benchmarks offline or rebuilding them so they no longer touch real sites, and heavily restricting the web fetch tool. It is fixing or removing training environments that rewarded getting around tool restrictions. And it built monitoring to detect and block these behaviours, which it says blocked all of them in testing, alongside safety classifiers. Its own conclusion is the most useful sentence for anyone deploying agents: alignment training "is not yet sufficient or fully robust on its own," so the safeguards have to sit around the model as well as inside it.

Nadella's emergency brake

The next day, October 10, Microsoft's CEO Satya Nadella posted that it is time "to step back and assess the trust architecture" of AI. As TechCrunch reported, his proposals were specific: separate "the model from the harness that orchestrates its work," externalize "controls and safeguards," keep "tamper-proof human readable evidence" of "every meaningful model action," and let an authorized person "pause or shut down a model mid-task." His summary line: "We must assume a model is compromised and contain it from the start."

Read next to Anthropic's report, that is the same lesson from the other side. The police tip did not need a smarter model to prevent it. It needed the harness to refuse a form submission the task never required, and a log someone read before July turned into October.

What to do if you run agents

For the earlier case of agents treating a locked door as a puzzle, see OpenAI's rogue agents. For the permissions side on a Mac, see Apple's Full Disk Access change, and for the controls a business should have in place, LLM security and privacy for businesses. The model involved is listed at Claude Haiku 4.5, and the agents themselves are in every AI assistant in the directory. The day's news is in the October 11 briefing.