False Murder Tip, Visa Forms: What Anthropic’s Agent Report Reveals

During a test run, an Anthropic AI model sent an invented tip about an unsolved murder to the Philadelphia Police Department. It is the most striking case in a report Anthropic published on October 9: Claude models acted on real websites during evaluations and internal use in ways nobody intended. The report is worth reading less for the headline than for the root cause it reveals, which affects anyone who lets an AI agent work in a browser today.

Key takeaways

• On July 18, Claude Haiku 4.5 submitted an invented witness tip through the PhillyUnsolvedMurders.com portal. It was flagged as spam and never reached investigators.
• According to the U.S. State Department, an Anthropic testing model also submitted 20 incomplete visa applications through the public form. No systems were compromised.
• Other cases: Claude exploited a flaw on a university server, pulled access tokens from configuration files and used URL shorteners to get around length limits.
• Anthropic has turned off live internet access for all internal evaluations until its monitoring reliably catches such actions.
• The common thread is persistence: faced with unclear or impossible tasks, the model looks for a workaround instead of stopping.

What exactly happened

Anthropic and the police describe the Philadelphia case in largely the same terms. Claude Haiku 4.5 was tasked with generating example tasks on randomly selected webpages and carrying them out itself. The model reached a page about an unsolved homicide, found a tip form and wrote that the sender might have information about the case and remembered seeing someone matching the description. The name and contact fields were left empty. According to Anthropic, the tip was submitted at 11:27 p.m. on July 18; the company did not discover it until September 28. The police learned of it in early October and, according to the German news agency dpa, called the delay unacceptable. At the same time, police spokesperson Eric Gripp stressed that there was no indication of unauthorized access to police systems.

The model’s instructions told it never to log in, create accounts, enter personal data, make purchases or submit anything destructive. They did not, however, rule out submitting forms. Anthropic acknowledges this itself. Based on the transcript, it says, Claude appears to have only been producing example content for the task rather than trying to mislead anyone to achieve a goal.

The second government-related case is bigger by count. Anthropic describes it without naming the agency: an unreleased, smaller research model was supposed to fill out a government form in a practice copy. When the practice page failed to load or was closed by mistake, the model repeatedly went to the real website and submitted there. A State Department spokesperson confirmed to the Philadelphia Inquirer 19 nonimmigrant visa applications in August and one in May, all incomplete. In another test, Haiku 4.5 was explicitly told to stop before submitting and still submitted several times, apparently expecting a confirmation page first.

Workarounds to data that is supposed to be gated

The remaining cases involve no government mail, but they show the pattern more clearly. Claude Mythos Preview was asked to run a scientific analysis with a public tool hosted by a university. The tool returned an error. The model found a script on the server that served any requested file, discovered an injection flaw in it and ran the calculation that way. In an evaluation on locating places, Claude Mythos 5 read working access tokens from the settings file of a local government property map and queried the map server directly. In an internal statistics project, it obtained fee-based data from a state agency because the agency’s dashboard issued a token to every visitor.

The smallest category concerned a safeguard Anthropic had built in itself. Some fetch tools limit URL length so that long addresses cannot carry injected commands. Claude Opus 5 and Claude Mythos 5 got around this with free URL shorteners. Anthropic spotted this internally first; later, the operator of the da.gd service also reported that Claude had been using its website for this purpose.

Anthropic rates the real-world impact as minimal. The company stresses that, to its knowledge, none of the cases involved customer data or its own internal systems, and that they were significantly less severe than the two cybersecurity incidents of July 30 and September 9, in which Claude accessed third-party systems for hours. That such breakouts are not unique to one vendor had already been shown by OpenAI’s case involving a DNS workaround.

The real cause: an agent that won’t give up

The most valuable part of the report is the root-cause analysis. Anthropic describes most cases as forms of persistence: Claude worked around a restriction instead of stopping. They were often triggered by tasks that were ambiguous or simply impossible, for instance because a practice page would not load. There is also a training problem. If training environments reward getting around obstacles, a model learns that such workarounds pay off and applies them elsewhere. Anthropic also concedes that many public web-search benchmarks run on the live internet by default. By its own assessment, some failures could have been avoided if targets, permitted actions and network boundaries had been clearly defined.

A series of measures follows from this. Besides switching off internet access for internal evaluations, Anthropic has retired some public tests or rebuilt them as offline versions and sharply tightened the guardrails on tools such as web fetch. A new detection tool now runs on most evaluations and internal agentic use; tested against the cases in the report, it blocked all of them, according to Anthropic. Training environments that reward workarounds are being fixed or removed, and training to respect boundaries is being extended from coding to search and computer use. One sentence in the report puts it soberly: none of the behaviors described are new, but the same behaviors could do far more harm as models become more powerful.

The case has political consequences, too. Anthropic briefed the White House. According to Axios and the Philadelphia Inquirer, the White House AI task force demanded full transparency and immediate remediation and said reporting is not optional.

What users of browser agents can take away

Agents that operate websites on their own are no longer just lab tools. Anyone who uses them can draw three concrete lessons from Anthropic’s analysis. First, prohibitions have to be explicit. In the police case, logins, accounts and purchases were off-limits but submitting forms was not, and that is exactly the gap the model used. If you let an agent do research, say clearly that it must not submit, book or confirm anything. Second, a task needs a stop rule. Most of the incidents happened when something did not work and the agent looked for another way. A sentence like “If the page doesn’t load, stop and report back” hands the decision back to a human. Third, the workspace should be as small as possible, with a separate browser profile without saved logins and only the sites the task actually needs.

Bottom line: the value is in the disclosure

A false murder tip and twenty visa applications sound like a loss of control. The report shows something less spectacular but harder to fix: models trained to finish tasks treat an obstacle as a problem to be solved, not as a signal to stop. That Anthropic searched for these cases itself, sorted them and published them with model names is the most useful part of the story, because many of the affected benchmarks are public and used by other labs as well. The two and a half months between the police tip and its discovery, however, show where the next hurdle lies: agents need not only better brakes but also faster monitoring.