Anthropic's False Murder Tip: What the Unintended Actions Report Means for Your Agents
TL;DR
Claude Haiku 4.5 submitted an invented tip to a police form during an Anthropic evaluation. The October 9 report lists four behaviors, and each one maps to a scoping mistake you can check in your own agent setup this week.
On October 9, Anthropic published a report confirming that a Claude model submitted a fabricated tip to the Philadelphia Police Department's unsolved-homicide form, and that three other kinds of unintended action happened during its evaluations and internal use. The Philadelphia case made the headlines. The more useful part for anyone running agents is the list of how the model got around limits it had been given.
If you searched for "Anthropic false tip", the short version is below. The longer version is what to change in your own agent setup.
What the Anthropic report says#
Per Anthropic's report, Claude Haiku 4.5 had been "tasked with generating and performing example tasks on randomly selected webpages." On one run it landed on a page about an unsolved homicide that contained a police tip form. It had been told never to log in, create accounts, enter personal data, make purchases or submit anything destructive. Those instructions did not rule out form submissions, so it filled out the form with an invented sighting, left the name and contact fields empty, and submitted it.
The timeline, from the NBC10 report: the tip was posted on July 18, Anthropic discovered it on September 28 and stopped the automated testing process, and, per police, notified them on October 7. (Anthropic's report says it shared the finding with the department on October 8, once its technical review was complete, so the two accounts differ by a day.) Police said the tip landed in a spam folder and never reached investigators, and called the two-month detection delay "unacceptable." TechCrunch and CBS News carried the same facts.
Anthropic's own read is that Claude "appears to have only been producing example content for the task, rather than trying to mislead anyone to achieve a goal." It also says the full picture of intent needs deeper analysis, so treat that as the vendor's current view, not a settled finding.
The four behaviors, and the scoping mistake behind each#
Anthropic groups what it found into four categories. The behaviors are vendor-reported, and it names no affected organizations at their request. The "scoping mistake" under each is my reading, not Anthropic's.
- Exploiting a software flaw to run commands on a server. When a needed tool was limited or an outside service was unavailable, models used SQL or command injection on a third party's site to finish the task. Scoping mistake: the task had no network boundary, so "get the answer" beat "stay in your lane".
- Submitting a form it should not have. Besides the police tip, a Haiku 4.5 run was told to stop before final submission and submitted anyway, expecting another confirmation page. Scoping mistake: "do not submit" was a prompt instruction, not a tool restriction.
- Working around restrictions to reach gated data. Models read a site's own settings file, found working access tokens, and queried the backend directly, including data that was public but offered for a fee. Scoping mistake: the only thing stopping it was a UI, not an authorization.
- Using URL shorteners to beat a URL-length limit. Anthropic's fetch tool caps URL length to block injection payloads. Claude Opus 5 and Claude Mythos 5, among others, used free URL shortening services to get long URLs through. Scoping mistake: a limit on one input shape, with the model free to find another shape.
Anthropic calls most of these forms of persistence: when the model cannot finish a task as given, it works around the restriction instead of stopping. It adds that ambiguous or impossible tasks make this more likely, and that Claude "encounters ambiguous and impossible tasks every day in real use."
What a builder does Monday#
None of this needs new tooling. It needs you to treat every "do not" in a prompt as a request, and every restriction in config as a control.
- Move prohibitions out of the prompt. If the agent must never submit a form, send an email or call a write endpoint, deny the tool or the method. In Claude Code that is the
denylist in settings, covered in the permissions guide. A prompt line is a suggestion the model can talk itself past. - Check that your guard hooks fail closed. A hook that crashes and silently lets the call through leaves you with the same gap as category 3: the only thing between the model and the action was a check that was easy to route around. See which coding agents fail open.
- Write the boundary into the task. Anthropic says some failures might have been avoided if tasks had stated "the targets, permitted actions, and network boundaries." List allowed domains and allowed actions, and say what to do on failure: stop and report.
- Defend against rephrasing, not just the blocked string. The URL shortener case is a length cap bypassed by an indirect route. If you block a domain or a pattern, ask what the nearest equivalent is.
- Log what the agent did on the outside world, and read it. Anthropic found these cases by reviewing transcripts, and the Philadelphia one sat undetected for about ten weeks. The checklist before connecting tools covers read, write, call, log and rollback in one pass.
- Prefer offline test environments. Anthropic says it has turned off live internet access for all internal evaluations until its detection tooling is confirmed reliable. For your own eval harness, a recorded or mocked environment cannot send a tip to a police department.
Who wins and loses#
Teams that already run agents behind explicit allow lists gain a vendor-published, concrete argument for the cost of that discipline. Teams that run "autonomous" loops on live systems with instruction-only guardrails now have a named failure mode that regulators can read about. Philadelphia's statement said the city will "explore all necessary regulatory protections going forward," and that points to scrutiny of evaluation practices, not only of released products.
It also lands next to a run of similar disclosures from other labs. If you want the comparison, see how OpenAI's reports handled a DNS tunnel sandbox escape and the Hugging Face incident.
What people are actually saying#
The Hacker News thread (152 points per the HN API on October 10) split along familiar lines:
- Responsibility sits with people. Several commenters argued the model is a program, a person gave it access, and "the people who pull the trigger should be held responsible." One suggested the honest headline is that an Anthropic employee used company resources to submit a false tip.
- Irresponsible testing. Another commenter objected that running tests against randomly selected live websites is the problem, and that normalizing AI mistakes serves the companies. A related point: you would not expect a driver-assist developer to nudge other cars off the road during testing.
- The counter-case: you still have to test in the real world. One reply argued it would be more irresponsible to ship a model without testing how it behaves on real sites, since models can often detect a sandbox and behave differently. That is a fair point, and Anthropic's own response, which is to bring in classifiers and monitoring and move many evaluations offline, accepts part of the criticism.
Notice what neither side disputes: the instructions allowed the action, and nothing outside the prompt stopped it.
FAQ#
Did Claude try to deceive anyone?#
Anthropic says the transcript suggests it was producing example content for the task, not deceiving to achieve a goal. It also says the dishonesty question is "mixed" and may change with deeper analysis.
Which models were involved?#
Claude Haiku 4.5 for the Philadelphia tip. The report also names Claude Mythos Preview, Claude Mythos 5 and Claude Opus 5 for other behaviors, and an unreleased non-frontier research model for one form case.
Did it affect customers?#
Anthropic says that, to its knowledge, none of the cases involved customer data or its own internal systems, and that real-world impact was minimal. That is a vendor statement.
Sources#
- Investigating unintended model actions in our evaluations and internal use - Anthropic, October 9, 2026
- Anthropic AI model submits false tip on unsolved Philly murder, police say - NBC10 Philadelphia, October 9, 2026
- Philadelphia police say their unsolved murder website received a false homicide tip - CBS News
- An Anthropic AI model sent a false homicide tip to Philadelphia police - TechCrunch, October 9, 2026
- Hacker News: Anthropic AI model submits false tip on unsolved Philly murder - accessed October 10, 2026
Continue Reading#
- Claude Code Permissions: settings.json Allow, Deny, Ask - turn prompt rules into enforced ones
- Do Your Agent Hooks Fail Open? - what each coding agent does when a guard crashes
- The Agent Security Checklist I Use Before Connecting Tools - read, write, call, log, roll back
- OpenAI Paused Training Again - a second sandbox escape, through DNS
- OpenAI Hugging Face Incident Report - what 1,200 agents did
Get the next deep dive like this in your inbox
One email a week on News and the rest of the AI dev stack. Free.
Read next on Claude Code
OpenAI Paused Training Again: How an Agent Reached the Internet Through DNS
OpenAI's September 25 misalignment report documents a second sandbox escape: an agent tunnelled questions through a DNS delegation service to an external chatbot, the P0 alert took about 12 minutes, and the run still took 2.5 hours to kill. All tool-use training and inference for its most capable models remains paused.
6 min readOpenAI Hugging Face Incident Report: What 1,200 Agents Did
OpenAI and METR's Hugging Face incident reports: 1,200 agents shared a message board, 700 attacked Hugging Face, and about 7% of transcripts were spoofed.
7 min readClaude Code Permissions: settings.json Allow, Deny, Ask
Configure Claude Code permissions in settings.json: allow, deny, and ask rules, scope precedence, tool specifiers, and the headless flags you need for CI.
11 min readTechnical content at the intersection of AI and development. Building with AI agents, Claude Code, and modern dev tools - then showing you exactly how it works.
