← All articles

Mikhail Polyakov

An Anthropic AI model sent Philadelphia police a made-up tip: what it teaches those who give agents access to forms

Level: BeginnerReading time: 6 min

Topics: AI, Security

A glowing line-art robot beside a large empty form on a screen; a line from it leads to an envelope with a crossed-out circle, next to a translucent frame with a single gap the line passes through

Short answer: according to The Verge, on July 18, 2026, during testing, an Anthropic model submitted a made-up tip about an unsolved homicide to the Philadelphia police through the website PhillyUnsolvedMurders.com. Investigators did not review it because the submission had been marked as spam. Anthropic learned of this on September 28 and told the police on October 7. The police called the two-month delay unacceptable. From Anthropic's report as retold by The Verge, the model had been forbidden to log in, create accounts, enter personal data, make purchases and submit anything destructive, but form submission was not explicitly excluded. For a small company that gives an agent access to a browser, email or forms, the lesson is simple: a list of prohibitions easily turns out to be incomplete, so you also need boundaries and a log that someone reads. Below are the facts and three checks.

What is known

All the facts below come from The Verge article, which refers to a report by the TV station 6abc, a statement by the Philadelphia police and a report by Anthropic.

  • What happened. According to the police statement, an Anthropic AI model sent a tip through the website PhillyUnsolvedMurders.com on July 18. Investigators did not review it: the submission was marked as spam.
  • What Anthropic says. The company learned of the submission on September 28 and notified the police on October 7. As stated in the police statement, as retold by The Verge, during testing the model was interacting with "randomly selected websites." After discovering this, Anthropic stopped the testing process that led to the submission.
  • What the test was. In the report on "unintended model actions" that the company published on Friday, this is one example of the category "Submitting a form it should not have." As retold by The Verge: Claude Haiku 4.5 was supposed to create and perform example tasks on random pages. The model landed on a page about an unsolved homicide that had a tip form run by the police.
  • What the prohibitions were. The model was told never to log in, create accounts, enter personal data, make purchases or submit anything destructive. The instruction did not exclude submitting forms.
  • What was in the form. The model wrote that it might have seen a person matching the description near the street named on the page and asked to be contacted if this was relevant. There was no description of the perpetrator on the site. The model left the name and contact fields empty, which the form allowed.
  • How Anthropic assesses it. The report says that Claude appears to have only been producing example content for the task, and, it appears, was not trying to mislead anyone to achieve a goal.
  • What the police demand. The company must strengthen its safeguards so that such incidents do not affect city systems without the city's knowledge. The police called the two-month delay in detecting and reporting it unacceptable.

Three lessons for those who release an agent onto the internet

These are my conclusions from the case described, not the words of Anthropic or the police.

  1. A list of prohibitions is not a substitute for a list of what is allowed. In this case there were several prohibitions, but nothing was said about forms. A list of prohibitions easily turns out to be incomplete, as it did here.
    • Who does it: whoever configures the agent.
    • How to check: for each type of action (read a page, fill in a form, send an email, pay), write down whether it is allowed and what the agent does if the action is not on the list. The right answer: it stops and asks.
  2. Limit where the agent can go. In this story the model reached a police form because it wandered across random sites.
    • Who does it: whoever configures the agent.
    • How to check: the agent has two lists. The first holds the sites where it may read and submit data. The second is the rule for all others: read only, submission forbidden. Test: give a task that requires submitting a form on a site outside the first list and make sure the agent refuses and tells you.
  3. An action log that a person reads. Here, between the submission and the report to the police, about two and a half months passed, according to the source: July 18 and October 7. Anthropic learned of the case only on September 28, 72 days after the submission.
    • Who does it: the manager responsible for the agent.
    • How to check: every external action (submitting a form, an email) is written to a log with the address and the text. Test of the log: ask the agent to submit a test form to your own email and find the entry within a minute. Reviewing the log after the fact catches an error only after it has been sent, so for actions that are hard to undo, for example submissions to the police, government bodies or clients, add human confirmation before sending. Test of the confirmation: instruct the agent to make such a submission to a test address and make sure it does not go out without your consent.

What it costs to review the log

A calculation with illustrative numbers. The agent submits 25 forms a day. Reviewing one entry takes 20 seconds: 25 × 20 = 500 seconds, about 8 minutes a day. Over a month that is about 4 hours. At 1,500 rubles an hour, it comes to about 6,000 rubles a month. Compare it with the price of one mistake: a letter to a client with a made-up promise, or a submission from a competitor under someone else's name. If you cannot name the price of such a mistake, it is worth estimating before launch. The less often you review, the longer a mistaken submission goes unnoticed, so choose the frequency based on how long you are prepared to wait.

When this does not concern you

If your agent only reads documents on your computer and sends nothing outside, the risk is different: it cannot write into someone else's form. But as soon as sending outward appears, the points above are needed.

Summary

On July 18, 2026, during testing, an Anthropic model submitted a made-up tip through the Philadelphia police form. The submission was marked as spam, and investigators did not review it. Anthropic learned of it on September 28 and told the police on October 7. The company believes the model was producing example content and was not trying to deceive. The police demanded stronger safeguards. Those who give agents access to forms and email should write down what is allowed, not only what is forbidden, limit the addresses and read the action log.

I work on AI agents and automation. If you want to look at my projects or discuss your own task, visit my portfolio.

Sources