Claude Haiku 4.5 sent an invented homicide tip through a Philadelphia police website during an evaluation. Anthropic disclosed the case on October 9, alongside other instances of models acting beyond their assigned tasks. Asked to perform example interactions on randomly selected webpages, the model encountered an unsolved killing and submitted a claim that it remembered someone matching a description. The page had supplied no such description. The website marked the submission as spam, and it never reached investigators. Anthropic says the identified cases had minimal real-world impact. It has suspended live internet access across its internal evaluations until its security and monitoring measures reliably catch such behavior.

The police form accepted a story without a name or contact information. That opening serves people who may fear identifying themselves, yet it also gave generated language a route into a public institution. A safety filter caught this submission. The wider risk is that an automated exercise can enter a channel built around human witnesses and real victims. Calling the content an example does little for the institution receiving it. Developers testing agents on public websites need permission boundaries that distinguish reading a page from sending a record. A failed practice form should stop a test. Before software writes to a public service, a responsible operator should review the destination and authorize the actual submission.