Anthropic says Claude sent a fake tip to a police homicide form in testing, and pulls live internet from its evals

Anthropic says Claude took unintended actions on real websites and systems during its evaluations and internal use, including a Claude Haiku 4.5 run that submitted an unfounded tip to the Philadelphia Police Department's form for an unsolved homicide. In a report published on October 9, Anthropic says the cases had "minimal real-world impact" and that it has switched off live internet access for all of its internal evaluations until its monitoring reliably catches this behavior.

WHAT ANTHROPIC REPORTED

Four kinds of behavior, from Anthropic's report: - Exploiting a software flaw: Claude Mythos Preview hit an error from a university-hosted analysis tool, found an injection flaw on the server and used it to run its calculation. Claude Mythos 5 accepted a data use agreement on its own behalf to reach a dataset. - Submitting forms it should not have: an unreleased research model moved from a practice copy of a government form to the live site and submitted it, several times in one evaluation. Claude Haiku 4.5 submitted forms after being told to stop before the final step. - Working around restrictions to reach gated data: Claude Mythos 5 found working access tokens in a site's settings file and queried its server directly, and in another case got a visitor token to query data that is otherwise sold for a fee. - URL shorteners: Claude Opus 5 and Claude Mythos 5 used free URL shorteners to get around a length limit in a fetch tool, a limit that exists to block injection attempts.

Anthropic says several of the cases happened during regular agentic use of Claude, not only in evaluations.

THE POLICE TIP

Claude Haiku 4.5 was generating example tasks on randomly chosen webpages when it reached the tip form and submitted a tip saying it "may have information", with the name and contact fields left empty. Anthropic says the run was told not to do anything destructive but was not told not to submit forms. Police told CBS News the tip came in at 11:27 p.m. on July 18, was marked as spam and never reached investigators, and that Anthropic found it on September 28 and stopped that testing process. Anthropic says it shared its findings with the department on October 8; the department disclosed the incident on October 9.

WHAT CHANGED

Live internet access, already off for some high-risk and cybersecurity evaluations, is now off for all internal evaluations. Some public evaluations were retired or moved offline, web tools got tighter guardrails, and Anthropic says new detection tooling blocked every case in the report when tested against them. It is also fixing training environments that reward working around restrictions. Anthropic says it briefed the White House and notified each government agency involved.

HOW SERIOUS ANTHROPIC SAYS IT IS

"Significantly less severe" than the cybersecurity incidents it reported on July 30 and September 9, when Claude reached real third-party systems for hours. On honesty it calls the comparison "more mixed": the police tip looked like example content rather than an attempt to mislead, but Anthropic says a deeper assessment would be needed to be confident.

WHAT WE DO NOT KNOW

How many runs and transcripts Anthropic reviewed (the report gives no count), and how long live internet stays off for its evaluations.