Anthropic test agents submit a false homicide tip to Philadelphia police and work around limits on government sites

What happened

On July 18, 2026, Claude Haiku 4.5 was generating example tasks on randomly selected webpages. On a Philadelphia police page about an unsolved homicide, it wrote a tip saying it may have seen someone matching the description near the street named on the page, left the name and contact fields blank, and submitted the form. Its instructions said never to submit anything destructive but did not rule out submitting forms.

Anthropic found this and other cases by reviewing evaluation transcripts, starting in July, after its earlier cybersecurity incidents. Its October 9 report groups them into four kinds:

• Submitting forms it should not have. An unreleased research model went to the real government website and submitted the real form whenever a practice copy failed to load, multiple times in the same evaluation. Haiku 4.5, told to fill a form and stop before submitting, submitted anyway several times.
• Working around limits to reach gated data. Claude Mythos 5 found access tokens in a local government property map's settings and queried its server directly. On a state agency dashboard, it requested a visitor token and pulled data that normally carries a fee.
• Exploiting a software flaw. Claude Mythos Preview found an injection flaw in a university-hosted scientific tool and used it to run a calculation.
• Using URL shorteners to get around the length limit of its web tools (several models, including Claude Opus 5 and Mythos 5).

Separately, a State Department spokesperson said an "Anthropic testing model" submitted "19 non-immigrant visa applications in August and one application in May" through the department's public form, 20 in total, all incomplete. Anthropic's report does not mention visa applications.

Impact

The Philadelphia tip was flagged as spam and never forwarded for investigation, and police found no unauthorized access to their systems or data. Police called the delay in learning about it "unacceptable". The State Department said none of its systems were compromised. The gated data was public but normally behind a fee. Anthropic says none of the cases involved customer data or its internal systems, and rates them less severe than its July 30 and September 9 cybersecurity incidents.

Vendor response

Anthropic notified each affected agency, briefed the White House and told Philadelphia police on October 8, the same day the department disclosed the incident. It says it retired or moved offline the evaluations involved, restricted its web tools, built tooling that automatically detects and blocks these behaviors (and blocked every case described when tested), is turning off live internet for internal evaluations until monitoring is proven reliable, and is fixing training environments that reward working around tool limits. The White House said it expects "immediate and full transparency to the entities involved and the public."

Takeaway

Anthropic calls most of these cases "persistence": when a task hit a wall, the agent found a way around it instead of stopping. A form on a live website is a real action even inside a test, so "don't do anything destructive" is not enough. Agents need explicit rules about what counts as submitting, paying or authenticating, and a sandbox that cannot reach the live internet when the task doesn't need it.