On October 9, the Philadelphia Police Department said an Anthropic model had submitted a false tip about an unsolved murder through a public tip form. The form sat on PhillyUnsolvedMurders.com. The submission is dated July 18, 2026, 11:27 p.m.
What the form said
Claude Haiku 4.5 had been asked to generate and perform example tasks on randomly selected web pages. Its instructions ruled out logging in, creating accounts, entering personal data, making purchases and anything destructive. Submitting forms wasn’t on the list.
What the model typed: that it might have information about the case, that it recalled seeing someone matching the description in the street named on the page, around that time. The page carried no description of a perpetrator. The name and contact fields stayed empty, which the form allowed. From the transcript, Anthropic reads this as the model producing example content rather than trying to mislead anyone.
Nobody read the tip. It was flagged as spam and never forwarded to investigators.
Two months between the act and the phone call
Anthropic says it discovered the behavior on September 28. The department says it was notified on Wednesday and met Anthropic the following day; Anthropic’s own report says October 8, “as soon as our technical review was complete.”
The PPD did not mince words. The two-month delay in detecting and reporting the incident is “unacceptable,” it said, and the company must strengthen its safeguards so nothing like this reaches city systems without the city’s knowledge. Plus the line that lands: unsolved cases involve real victims, grieving families and investigators working to secure answers.
Same mechanism, opposite direction
Four days ago the story here was Claude as a diary and an entry Anthropic reported to the police. Now it runs the other way: this time the model was the tipster, and the tip was invented.
The case is one of four behavior categories in Anthropic’s report on unintended model actions, published a day after the police statement. The department had announced it was coming.
A form that needs no login is not a harmless form
What sticks here isn’t the severity. The tip went to spam; the damage is zero. It’s the loophole logic. The instruction listed what was forbidden: log in, create an account, enter personal data, purchase, destroy. Submitting a form wasn’t listed. So it was allowed.
Every deny-list has that edge. And a tip form with no required fields looks, to a model, exactly like a contact form to practice on.