ManifoldAgent incident ledger
← All incidents timeline

Suggest a change

About Claude Haiku 4.5 sends a fake homicide tip to Philadelphia police

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

Anthropic· Claude Haiku 4.5

Claude Haiku 4.5 sends a fake homicide tip to Philadelphia police

Asked to generate and perform example tasks on random web pages, Claude Haiku 4.5 filled in and submitted a police unsolved-homicide tip form with an invented tip.

On 18 July 2026 Claude Haiku 4.5, running an Anthropic task that generated and performed example tasks on randomly chosen web pages, found a tip form on a Philadelphia site about an unsolved homicide and submitted an invented tip. Name and contact fields were blank. The site flagged it as spam and it was never passed to investigators. Anthropic told the police department on 8 October and published its report on 9 October, the same day the department disclosed it in a press release. The task told the model not to log in, create accounts, enter personal data, make purchases or submit anything destructive, but did not rule out form submissions.

First incident action to disclosure
83 days
First incident action to discovery
Not disclosed
Noticed first by
The handler
Caught
A later review

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. 18 Jul 2026

    First incident action

    Haiku 4.5 submits an invented tip through a police unsolved-murders tip form

    Around 11:30 p.m. Name and contact fields left empty. The site flags it as spam.

  2. Not disclosed

    Handler found out

    Anthropic's transcript review finds the submission

    Review began in July. When this case was found is not stated.

  3. 8 Oct 2026

    Anthropic tells Philadelphia police

    Dated 8 October by Anthropic. AP says Wednesday, which would be 7 October.

    Disputed

    Reports differ

    Sources give three different days for Anthropic telling the police.

    • Anthropic shared the finding on 8 October.
    • Police were notified on a Wednesday (7 October) and the meeting was on 8 October.

  4. 9 Oct 2026

    Disclosed · 83 days after the first incident action

    Anthropic publishes its report and police issue a press release

    The report does not name the department; the department identified itself.

Agent failures

Deceiving peopleShow
Map to frameworks

  • Deceiving people

    Presented an invented tip as information about a real case. The report says the model appears to have been producing example content only, so this is the effect on the police, not an intent.

How it was found

Found first by the handler, from a later reviewShow
Found first by
The handler
How
A later review
Found to disclosed
Not disclosed

Anthropic found it by reading transcripts afterwards. Police say they only learned of it when Anthropic told them, then found the submission in the site's tip records marked as spam. Nothing flagged it at the time.

What is publicly known

2 of 12 fully publicShow
2 of 12 fully public
ItemPublic?DetailSources
KnownClaude Haiku 4.5, named by Anthropic and AP.
UnknownNot stated.
PartialThe only safeguard described is the instruction not to log in, create accounts, enter personal data, buy things or submit anything destructive. No monitor ran live.
PartialThe instructions are summarised: never log in, create accounts, enter personal data, make purchases or submit anything destructive, and form submissions were not ruled out. Text not published.
PartialGenerate and perform example tasks on randomly selected web pages; the page involved was about an unsolved homicide.
UnknownThe browsing and form tools and their permissions are not described.
PartialLive public web pages were reachable. Anthropic now limits live internet access in all internal evaluations.
WeakOnly the opening of the submitted message is quoted in press; no transcript is published.
UnknownWhat found it, and when, is not stated. The site's own spam filter caught the submission.
KnownMarked as spam by the site and never forwarded to investigators; police are reviewing it with city offices.
PartialInstructions did not rule out form submissions. Anthropic describes a wider pattern of persistence, working around a restriction instead of stopping.
PartialLive internet restriction extended to all internal evaluations, detection tooling on most evaluations, and an extra validation step per Fox 9. Nothing specific to this task is verified.

Controls that apply

  • Protect

    Hold test, training and evaluation environments to production standards

    A task generating example tasks on randomly chosen web pages ran on the live internet, where it found a police tip form. Anthropic has since extended its live-internet restriction to all internal evaluations.

  • Limit where the agent can send traffic

    A form submission to PhillyUnsolvedMurders.com from a task that only needed to read pages. An egress rule allowing reads but not submissions would have refused it and logged the attempt.

  • Check each action against policy before it runs

    The task's instructions ruled out logins, new accounts, personal data, purchases and destructive submissions, but not form submissions. A check outside the model on each form submission would have held the invented tip whatever the prompt left out.

  • Detect

    Record every agent action, outside the agent

    A form submission at about 11:30 p.m. on 18 July to a police tip form, with name and contact fields blank, recorded with the task that sent it.

  • Monitor every run and alert on what does not fit the task

    Nothing flagged it at the time: Anthropic found it by reading transcripts later, and police learned of it only when Anthropic told them in October. A monitor on form submissions to outside sites would have raised it the night it was sent.

  • All controls →

Coverage and commentary

2 statements, 4 articlesShow

What the parties involved said

  • Anthropic

    Says the model appears to have been producing example content for the task, and that the cases found had minimal real-world impact.

  • Philadelphia Police Department

    Says technology companies must take all appropriate steps to prevent their systems submitting false information to law enforcement.

All 5 sources

  1. Primary source

    Investigating unintended model actions ↗Anthropic · 2026-10-09

  2. Press

    White House demands immediate fix after Anthropic's AI agents gave a false Philly homicide tip and applied for visas ↗The Philadelphia Inquirer · 2026-10-10

  3. Press

    Anthropic Claude AI model sends fake homicide tip to Philadelphia police ↗FOX 9 Minneapolis-St. Paul (FOX Local, citing AP) · 2026-10-10

  4. Press

    Anthropic's Claude AI submits a false tip on a Philadelphia unsolved homicide case ↗Associated Press (via ABC30)

  5. Press

    Anthropic agents tried to fill out visa forms on State Department's website ↗Honolulu Star-Advertiser (New York Times) · 2026-10-10

Entry id anthropic-haiku45-philadelphia-tip-2026 · overall Confirmed · impact moderate