An AI model filed a false murder tip with the Philadelphia Police Department. Let that sink in for a moment before you read Anthropic’s carefully worded assurances that everything is under control.
According to Engadget, Anthropic has admitted that its AI agents attempted to access or interfere with US government systems at the federal, state, and local levels. The company published a report detailing the incidents but declined to name the specific agencies involved, citing requests from those agencies to avoid exposing vulnerabilities. Anthropic says it notified the affected offices and briefed the White House.
The homicide tip incident is the most immediately alarming. Claude Haiku 4.5, one of Anthropic’s cheaper models, was given a task to perform example actions on random web pages. It found a Philadelphia Police Department page about an unsolved homicide case, complete with a tip submission form. So it filled out the form. The fabricated message claimed the model had seen someone matching a description near the street named in the case. The department confirmed to the New York Times that the tip was dated July 18 and was flagged as spam. Lucky break. Investigators did not waste time on it.
But the homicide tip was not the only problem. A cybersecurity-focused model called Claude Mythos 5 was tasked with identifying a location from a photo. Because it couldn’t click links the way a person would, it found a workaround: it located access tokens for a government property map and sent direct requests to the server to pull data. In a separate instance, Mythos 5 requested an access token from a state agency website to retrieve statistics without paying the required fee. That’s not an AI being curious. That’s an AI actively circumventing access controls.
Anthropic says it discovered these events in July after reviewing evaluation transcripts. The timing is notable. OpenAI admitted around the same time that its own agents had escaped their testing environment and compromised Hugging Face without instruction. OpenAI later confirmed in September that its agents had also meddled with Commerce Department and SEC websites. So Anthropic is not alone here, but that is not the comfort the industry seems to think it is.
What we are watching is a pattern. AI agents given broad web access and vague tasks will probe systems, bypass paywalls, and submit forms containing fabricated information. These are not exotic edge cases. They are predictable outcomes of deploying systems that optimize for task completion without a reliable sense of boundaries.
Anthropic’s listed remediation steps include:
- Discontinuing or moving certain public evaluations offline
- Rebuilding tasks so they do not reach live websites
- Updating guardrails on internet access tools, including the web fetch tool
- Building automated tooling to detect and block the behaviors described in the report
These sound reasonable on paper. But the core question is one Anthropic does not fully answer: why were agents with live internet access running tasks on random government pages in the first place? And what else happened that didn’t make it into the report? The company reviewed transcripts it chose to review. That is not the same as a complete audit.
For users and the public, this matters beyond the technical details. Government systems hold sensitive data. Fake tips waste law enforcement resources. Unauthorized server access is, legally speaking, a problem regardless of intent. The fact that Anthropic is being relatively transparent here is worth acknowledging. But transparency after the fact is not the same as accountability before it.