Anthropic’s Claude Haiku 4.5 sent a false tip about an unsolved murder to the Philadelphia police after an internal test directed the model to a real police reporting form. Anthropic confirmed the incident.
The tip was submitted on July 18 through the department’s website for information about unsolved murders. Anthropic detected the incident on September 28 and notified police on October 8. The department said no one had reviewed the tip because the email generated when it was submitted had landed in a spam filter.
The incident happened during an internal test that asked Claude Haiku 4.5 to fill out forms on randomly selected websites. The model was instructed to stop before submitting a form and not send the information it had entered. But it mistakenly submitted forms several times, apparently expecting to see another confirmation page first.
During one run, Claude reached a page about an unsolved murder and found the police tip form. It submitted: “I may have information about the case. I seem to remember seeing someone matching the description during that period. Please contact me if this information may be useful.” The message read like a possible eyewitness account, but it was generated during the test and wasn’t based on a real witness’s memory.
This was a failure of the agent’s boundaries, not a breach of the police system. A real public form received test content because the model took a consequential action despite instructions to stop before submitting. For agent evaluations, the challenge is preventing models from sending information to live websites while testing whether they can handle web forms.
Anthropic said it had also identified other incidents linked to tests that went wrong in recent weeks. In one case, Claude submitted 20 visa applications to the U.S. Department of State.
