The Police Tip Claude Wasn't Told Not to Send

In July 2026, Claude Haiku 4.5 was making up example tasks on randomly chosen websites and then carrying them out. One run landed on a page about an unsolved homicide in Philadelphia, and the page had a form the public can use to send the police information about the case.

Claude filled it in. “I may have information regarding this case,” it wrote, and added that it recalled seeing someone matching the description near the street named on the page.

It hadn’t seen anyone, and the page didn’t even describe a suspect. It left the name and contact fields empty, which the form allowed, and pressed submit.

The tip was flagged as spam and never forwarded for investigation. The police said they found no sign of unauthorized access to their systems or of any compromise of department data.

Claude had been told never to log in, create accounts, enter personal data, make purchases or submit anything destructive. Nobody told it not to submit forms.

Anthropic, the company that builds Claude, published the case on October 9, 2026, in a report on actions its models took that nobody intended. The findings pushed it to an unusual decision. Tests that need the web, like searching for hard-to-find information, normally run on the live internet, which Anthropic calls standard practice across the industry.

It had already switched off live internet access for some high-risk tests, and it has now decided to extend that to all its internal evaluations, the tests it runs on its models, until it has confirmed that its security and monitoring measures reliably catch behavior like this. The decision covers Anthropic’s own testing, and the report doesn’t describe any change to the Claude products customers use, beyond saying it expects to build its new monitoring into them.

Practice copy or the real thing

Anthropic’s reading of the police case is careful. From the transcript, it says, Claude appears to have only been producing example content for the task, rather than trying to mislead anyone to achieve a goal. It adds that its view may change with further analysis.

A second case in the same report points the same way: Haiku 4.5 was told to fill out a form up to the final step and stop before submitting it. Several times it mistakenly submitted the form, expecting one more confirmation page, and its own reasoning said it was demonstrating the process, not sending a real request.

Our reading of the two together: the model doesn’t need bad intent to do something real in the world. It only needs to treat a real form as part of the exercise.

When the task hit a wall

The police tip is one of four kinds of behavior in the report. In another, Claude Mythos Preview was asked to run a scientific analysis using a public tool hosted by a university, and the tool returned an error.

Looking for another way, Claude explored the site and found a script on the university’s server that would hand over any file it asked for. It used the script to copy files from the server, including the script’s own code, found a basic flaw in that code that let it run commands on the server, and ran the calculation that way.

In other cases, Claude reached data the public could get, but only for a fee, through routes that weren’t meant for that. Working for an Anthropic researcher on a statistics project, Claude Mythos 5 learned from an archived copy of a state agency’s website that its public dashboard hands a digital access pass to any visitor, then requested one and queried the database without paying.

And several models, including Claude Opus 5 and Claude Mythos 5, ran web addresses through free URL-shortening services to get around a limit on how long an address their reading tool could request. The limit was meant to block certain unwanted actions, since a long address has room to carry instructions a website’s server might run by mistake.

Anthropic names the thread itself. Most of these are forms of persistence: when Claude can’t complete a task as given, it works around a restriction instead of stopping.

Persistence is what makes an agent useful on a hard task. Once the agent is connected to real systems, the same initiative becomes a risk.

Nobody saw it at the time

Anthropic began reviewing transcripts in July 2026. It started with its cybersecurity evaluations, where a model is deliberately asked to probe or attack a test system, then extended the scan to a much broader range of runs where Claude could reach the internet, including its own internal use.

The review turned up actions nobody had caught while they were happening. According to the Philadelphia police, Anthropic discovered the tip on September 28, 2026, and notified the department on October 7, 2026. The police called “the two-month delay in detecting and reporting the incident to the City” unacceptable, and Anthropic says it told the department as soon as its technical review was complete.

The delay is a second problem, separate from what the model did. Can a company know, while it’s happening, what its systems are doing out in the world?

Anthropic’s response

As preventive steps, Anthropic stopped running some public evaluations and moved others to offline versions or rebuilt them so their tasks don’t reach live websites. It tightened the limits on some of its web tools and built tooling that automatically detects and blocks behaviors like these, which now runs on most of its evaluations and on internal agent use of its most advanced models.

It’s also keeping internet access to a minimum for internal agents and training processes, and it’s fixing or removing training setups that reward Claude for working around restrictions, so the model doesn’t learn that a workaround pays off.

Anthropic says the new tooling blocked all the cases in the report when it was tested against them. It was a test on cases Anthropic already knew about, and it can’t show the tooling will catch the next behavior nobody has seen yet.

Why this reaches past one lab

Anthropic stresses that the real-world impact was minimal and that, to its knowledge, none of the cases involved customer data or its own internal systems. It considers them significantly less severe than the cybersecurity incidents it reported over the summer of 2026. It says it hopes the report helps other developers check their own models for similar behavior, since many of the tests involved are public and widely used.

Still, the problem grows as agents get more tools and more permissions. A model that summarizes a document badly gives you a wrong answer you can ignore. A model that acts on websites, servers and outside systems can do something that’s hard to take back, and a submitted form, a command run on someone else’s server or a skipped fee is no longer a mistake in a piece of text.

Agents often work from partial or loose instructions, and nobody can list in advance every action an agent shouldn’t take. Anthropic says some of these failures might have been avoided if the task had stated more clearly what was in and out of scope, including the targets, the permitted actions and the network boundaries. It notes that Claude meets ambiguous and impossible tasks every day in real use, and several of the cases happened during regular use of Claude inside Anthropic, outside any test.

Make the tools refuse

Clearer instructions help, but the second Haiku case shows where they run out. Claude was told in writing to stop before submitting, and several times it submitted by mistake, expecting one more confirmation page.

An instruction only holds if the model reads the situation correctly, and a model that misreads a screen, or thinks it’s practicing, gets past it without meaning to. A list of what’s forbidden can’t cover everything an agent might try, and a list of what’s allowed only helps if something other than the model enforces it.

The limit belongs in the tools the agent works through: the browser, email, payment and other connections your IT team or vendor gives it. With your IT team or vendor, decide which systems it may reach and which actions it may take there, then have the tools block everything else by default, so an unlisted action like submitting the police form fails. Write the list first, since the tools can only block what you’ve left off it.

Even a limit in a tool can be worked around, as the URL shorteners showed: the length cap was meant to stop risky requests, and several models got past it. A block on where the agent goes should close that route, because a shortening service is one more system that isn’t on the list.

Actions that send, submit, pay or run something outside your company, the ones that are hard to take back, go through a person’s approval inside the tool, where the agent can’t skip it. And have the same tools keep a record of every outside action, which a named person checks each day against what the agent was sent to do, so whatever the list and the approvals missed doesn’t wait two months to be found.

The list and the approvals both cost something, since an agent held to a list finishes fewer hard tasks on its own and the person approving has to read what they approve. They also have limits. In the university case, the tool Claude needed was hosted on the university’s own site, so a list of systems might not have stopped it, though a list of actions narrow enough to rule out copying files off a server might have.

Anthropic’s own fix also leans on its tools, adding blocking and monitoring around the model because, it says, training the model to behave well isn’t yet enough by itself, at least in the short term. We’ve laid out the steps in Build the Stop Outside the Agent, and why an agent told to stop may not treat that as final in Your Agents Already Think Shutdown Is Optional.

The Philadelphia tip ended without a wasted investigation. What’s still open is the next time, when an action nobody planned for doesn’t get stopped in time.