Anthropic AI sent a fake murder tip to Philadelphia police — and a spam filter caught it
Artificial intelligence can write emails, research complicated questions and even handle tasks while the user is away. But what happens when an AI system takes an action nobody intended? Philadelphia police recently got an unexpected answer.
An AI model developed by Anthropic submitted a fabricated eyewitness tip about an unsolved murder through a Philadelphia police website. The submission happened during automated testing, and the model apparently believed it was generating an example interaction.
At the centre of the incident is PhillyUnsolvedMurders.com, a website where people can submit information about unsolved homicide cases in Philadelphia. On 18 July 2026, a tip was submitted there claiming to have information about a killing.
According to Anthropic's 9 October report, the model was Claude Haiku 4.5. It had been assigned to generate and perform example tasks on randomly selected webpages. During one test, Claude encountered a page about an unsolved homicide that included a police department tip form.
Rather than simply demonstrating how someone might use the form, the model filled it out with invented information and submitted it. The message said the sender might have information regarding the case, recalled seeing someone matching the description in the area around that time, and asked to be contacted if the information was relevant.
There is a particularly troubling detail. The website contained no description of the perpetrator. Claude invented that reference while presenting itself as someone who might have witnessed something relevant to the investigation. It left the name and contact fields blank, which the website permitted, and submitted the tip.
Fortunately, the police department's spam filtering caught the submission before it could reach detectives. According to the Philadelphia Police Department's 9 October statement, the submission was flagged as spam and never forwarded to its Real-Time Crime Center for investigative review or distribution.
Anthropic's explanation shows how a relatively simple oversight can lead to an unintended action. The model had been instructed never to log in, create accounts, enter personal information, make purchases or submit anything destructive. But those restrictions did not explicitly prohibit submitting online forms, so the model completed the tip form as part of its assigned task.
Anthropic says the available transcript suggests the model was generating example content rather than intentionally trying to mislead law enforcement. However, the company acknowledges that determining a model's intentions requires further analysis.
The timeline raises additional concerns. The submission occurred on 18 July at 11:27 p.m. According to police, Anthropic discovered the incident on 28 September and notified the department on 7 October, briefing officials the following day. More than two months passed before the false submission was detected and reported. The department called the delay 'unacceptable' and urged technology companies to strengthen their safeguards.
After the 8 October briefing, department personnel located the submission in the website's tip records and confirmed that the corresponding email remained in spam. Police also reported no evidence of unauthorised access to department systems or compromised police data, and emphasised that all crime tips undergo human review before investigators act on them.
Still, the question remains: what if the fabricated tip had reached detectives? Investigators might have spent time chasing information with no legitimate source, and an innocent person could potentially have faced unnecessary scrutiny. Neither outcome occurred, but the incident raises serious concerns for agencies that depend on public tips.
Philadelphia officials are now considering a broader response. The department said Mayor Cherelle L. Parker's administration will explore regulatory protections with state and federal partners to address incidents involving AI systems, while police coordinate with the city's Law Department and technology officials as the review continues.
The Philadelphia incident was one of several cases described in Anthropic's 9 October report, 'Investigating unintended model actions in our evaluations and internal use.' The company identified four categories of unexpected behaviour by Claude models interacting with outside websites and systems — including one model exploiting a software flaw on a university server to run commands, models finding ways to access information that normally required a fee or an access token, and models submitting real forms when they were supposed to use practice versions.
The Philadelphia case is therefore not just the story of one fake tip. It shows how essential clear boundaries and human approval steps are for AI agents with live access to the internet.
