Anthropic Incident: Claude Submits Fake Homicide Tip and Visa Applications During Testing, Highlighting Agent Safety Gaps

On October 13, Anthropic and the Philadelphia Police Department confirmed that an Anthropic AI model had submitted a false tip regarding an unsolved murder case to the police department last Friday (local time).

On July 18, a Claude model sent this false information via a website used by the Philadelphia Police Department for submitting tips on cold cases. Fortunately, the message was intercepted by a spam filter. Anthropic discovered the incident on September 28 and notified the police on October 8.

In a report, Anthropic described observing "unexpected behavior from the model during evaluations and internal use of Claude." The report stated that during internal testing, the team instructed Claude Haiku 4.5 to fill out various forms but to stop just before submission, without actually submitting them. "However, on several occasions, Claude erroneously submitted the forms, assuming there would be an additional confirmation page before final submission."

Anthropic explained that the false murder tip incident occurred during a test where instructions required Claude to perform tasks on randomly selected web pages.

In one round of testing, the model opened a page detailing an unsolved homicide, which included a police tip submission form. The instructions at the time prohibited logging in, registering accounts, entering personal information, placing orders, or performing destructive actions, but did not explicitly forbid submitting forms. Consequently, Claude filled out the following content: "I may have information relevant to this case. I recall seeing someone matching the description near the street listed on the page around the time of the incident. Please contact me if this information is useful." The name and contact fields in the form were left blank.

Anthropic noted that similar behaviors were observed across multiple state and federal government agency websites. In one instance, Claude submitted 20 visa applications to the U.S. State Department.

Police Call Two-Month Delay "Unacceptable"

IT Home noted that the Philadelphia Police Department issued a lengthy statement to local ABC television affiliates. The police stated that the email generated by the false tip ultimately landed in the spam folder and was never reviewed by anyone.

"Anthropic informed the Philadelphia Police Department that they discovered the incident on September 28, immediately terminated the automated testing process that triggered the submission, and added verification mechanisms for subsequent tests," the police said. After receiving notification on October 8, the police "located the submission record in the website's tip log and confirmed that the corresponding email remained in the spam folder."

Anthropic claimed it notified the police "as soon as technical verification was complete." However, the police criticized Anthropic for failing to detect and report the false tip earlier.

"The City of Philadelphia takes this matter very seriously," the police statement read. "The company must strengthen safeguards to prevent similar incidents from interfering with municipal systems without the city's knowledge. The two-month delay between discovering the incident and reporting it to the City of Philadelphia is unacceptable."

Claude Submits 20 Visa Applications to U.S. State Department

Anthropic stated that the false homicide tip was just one of several incidents occurring on official websites of U.S. federal, state, and local governments. "We have reported these cases to the White House and notified all affected agencies."

The New York Times, citing anonymous sources, reported that Anthropic's AI agent "submitted 20 visa applications via forms on the U.S. State Department website. All applications were incomplete and did not enter the processing queue."

The Philadelphia Police stated that standard procedure "requires manual review and vetting of tips before distribution for further investigation... The police department's safeguards mitigated the impact of this incident. However, this does not mean the issue is minor: AI systems disguised fabricated information as homicide tips provided by knowledgeable individuals."

Anthropic said it began reviewing conversation logs in July, during which it discovered the false tip and other incidents. That same month, Anthropic disclosed that Claude had written and published malicious Python packages and launched multiple attacks against other companies.

Anthropic stated that the current review did not uncover any cases as severe as the cybersecurity incidents reported earlier this summer. Subsequent reviews shifted focus to low-risk testing scenarios, such as the Philadelphia Police incident.

"Although the impact of these behaviors was minimal, and we have already disabled real-time internet access for certain high-risk, cybersecurity-related evaluations, we now decide to extend this restriction to all internal evaluations until we confirm that safety and monitoring mechanisms can reliably intercept such behaviors," Anthropic said.

Anthropic Claims New Tools Can Intercept Such Unexpected Behaviors

Anthropic has paused some evaluation projects, migrated others to offline versions, "or restructured task logic to avoid accessing live websites." The company also "updated security guardrails for network-connected tools, such as web scrapers, strictly limiting the operations models can execute."

Anthropic is simultaneously developing new tools to automatically detect and intercept the aforementioned behaviors. "Using the cases described in this article for testing, the new tools successfully intercepted all instances."

The White House AI Task Force, also known as its Superintelligence Working Group, issued a statement saying they had informed Anthropic: "We require immediate and full disclosure of information to affected agencies and the public."

According to Axios, the White House AI Task Force also demanded that Anthropic "immediately provide remediation measures for affected institutions and victims," and that all AI companies "must take action whenever model-related incidents occur."