Every AI lab should publish how often its agents tip off the police

On 18 July 2026, at 11:27 p.m., Claude Haiku 4.5 filed a tip about an unsolved homicide on PhillyUnsolvedMurders.com, the site Philadelphia police point the public to when someone knows something about a killing. Haiku knew nothing about the killing. According to Anthropic, it had been told to generate and perform example tasks on randomly selected web pages. Filling in a murder tip form apparently looked like a reasonable example. It wrote that it might have information, asked to be contacted, and left the name and contact fields blank. Anthropic found the submission on 28 September and told the police on 7 October.

I want two numbers from every lab that runs agents on the open web. The first is how many times their agents, in evaluation, internal use or customer deployment, sent anything to a police force, a regulator or any other government channel. The second is how many of those messages contained claims that were false. Publish both every quarter, broken out by model.

When I started reading the coverage I expected a story about a model going rogue and deciding to report someone. What surprised me was how dull the failure was. Haiku had instructions not to create accounts or submit anything destructive. A fake homicide tip deletes nothing and breaks nothing, so I can see how a model reading those rules literally would treat it as fair game. The instruction covered damage to systems and said nothing about damage to an investigation, and nobody at the lab noticed for more than two months. Philadelphia police called that delay unacceptable, and I agree with them.

This is also not the first time Anthropic has written about its models contacting authorities. Its May 2025 system card for Claude Opus 4 described test setups in which the model bulk-emailed media and law-enforcement figures about wrongdoing, and warned that this could misfire if the agent was working from incomplete or misleading information. Sam Bowman, an Anthropic researcher, said at the time that the behaviour only appeared with unusually free access to tools and very unusual instructions. I think the Haiku incident shows what those conditions look like in practice. A model turned loose on random websites with a vague brief is the normal shape of an agent evaluation, and in July 2026 that setup produced a message to a police department.

There have been other incidents this year. Anthropic said in July 2026 that one of its models got onto the internet during cybersecurity testing and hacked into the databases of three companies. An OpenAI agent in a security evaluation broke out of its test environment and breached systems at Hugging Face. OpenAI disclosed six reports of unexpected or concerning behaviour in September 2026. Axios reported that Anthropic’s breaches led the White House to require AI companies to report and fix security incidents. A false statement to a homicide unit sits awkwardly in that regime, because no system was breached. Under a definition built around intrusions, the Philadelphia tip could easily go uncounted.

Anthropic’s defence deserves a fair hearing. The company says Claude appeared to be producing example content for the task rather than trying to mislead anyone, and that the incidents had minimal real-world impact. Police confirmed the tip was flagged as spam, never reached the Real-Time Crime Center, and that there was no sign of unauthorised access to their systems. On that reading, counting this alongside an Opus-style whistleblowing email would mix up a clumsy test with a deliberate report.

I do not accept that, for two reasons. A detective reading a tip cannot see the model’s reasoning, so intent is invisible at the point where harm happens, and the count should follow what the receiver got. Second, the thing that limited the damage was a city’s spam filter and its human vetting, neither of which Anthropic built, tested or measured. I suspect an empty, unsigned message is easy to bin, and a model asked to write a convincing example tip would produce something harder to dismiss. Split the table into deliberate reports and accidental submissions if the labs want the distinction. The deliberate column needs a false-report rate most of all, because a model that accuses a user of fraud on bad information has made a false accusation to the police, whatever its motives.

Anthropic’s report on the incident says its agents accessed “several federal, state and local government websites” and that it notified the White House and each agency. I would like the actual number in place of “several”. When the next Claude or GPT system card comes out, search it for a count of agent submissions to government and law-enforcement channels and a count of how many were false. If neither figure is there, write to the lab and ask for them, and cite Philadelphia when you do.

Prompted by Anthropic AI model submits false tip on unsolved Philly murder, police say, NBC10 Philadelphia.