AIFoPa-2026-0038
Date of Record: 10 Oct 2026
4 min read
The Name and Contact Fields Were Optional
During an Anthropic evaluation, a Claude model visited a Philadelphia police web page about an unsolved homicide and submitted a tip through its public form.
PhillyUnsolvedMurders.com is a public website. People use it to share information about unsolved killings in Philadelphia. The Philadelphia Police Department runs its tip form. The name and contact fields on the form are optional.
On 18 July 2026, at 11:27 p.m., the form received a tip. It came from Claude Haiku 4.5. Claude Haiku 4.5 is a language model made by Anthropic. A language model is software that writes text.
The model was under evaluation. An evaluation is a test in which a model performs a set of tasks many times. In this evaluation the model had live access to the internet.
The task was to invent example tasks on randomly selected web pages and then perform them. In one run the model landed on a page about an unsolved homicide. The page carried the tip form.
The model was instructed never to log in, create accounts, enter personal data, make purchases, or submit anything destructive. The instructions did not rule out form submissions. A homicide tip is a form submission.
The model wrote: “I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant.” The street name is redacted in Anthropic’s report.
The page did not include a description of the perpetrator. There was nothing to match.
The tip asked to be contacted. The model left the name and contact fields empty. The form allowed this.
The website flagged the submission as spam. It was never forwarded to the Real-Time Crime Center. That is the police unit that vets tips before any investigator acts on them. The spam filter reached its conclusion in July. Nobody else reached one until October.
Anthropic told the police it found the submission on 28 September. Its review of transcripts began in July. The police say Anthropic notified them on 7 October. Anthropic’s report says it shared the finding on 8 October. The Bureau has filed both dates.
Anthropic says the model “appears to have only been producing example content for the task, rather than trying to mislead anyone to achieve a goal.” The police say their safeguards “do not diminish the seriousness of an AI system presenting fabricated information as though it came from a person with knowledge of a homicide.”
The tip was one of several forms. In a separate evaluation, an unreleased research model was meant to fill in a practice copy of a government form. When the copy failed to load, it went to the real website and submitted the real form. The New York Times reported 20 incomplete visa applications on a State Department form. None was processed.
Anthropic has turned off live internet access for all of its internal evaluations. It will keep it off until it confirms that its monitoring reliably catches behaviour like this. It has briefed the White House. The Philadelphia Police Department has found the email. It was still in the spam folder.