Claude Haiku 4.5 sent the Philadelphia Police Department (PPD) a false homicide tip, Anthropic and the PPD announced.
In an Oct. 9 blog post about Anthropic investigating unintended model actions, the company described the incident and several others in which different Claude models performed actions they weren’t asked to perform.
In this case, Claude Haiku 4.5 was tasked with generating and performing example tasks on randomly-selected webpages. The model landed on a PPD tip form about an unsolved homicide. The model was instructed not to log in, create accounts, enter personal data, make purchases, or “submit anything destructive,” according to the post — but the list of don’ts didn’t include submitting forms.
So, Claude filled out the tip form:
Mashable Light Speed
I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant.
Claude didn’t fill in the name or contact fields, nor did he provide a description of the imaginary suspect.
The PPD provided more details in a statement shared with 6abc Philadelphia. Claude submitted the form to PhillyUnsolvedMurders.com on July 18. The tip went to spam and was never acted upon. Anthropic discovered the incident on Sept. 28 and notified PPD on Oct. 7.
The statement went on to say that PPD has a vetting process for tips, including a human review, before any follow-ups. “Those PPD safeguards limited the impact of this incident,” PPD stated. “They do not diminish the seriousness of an AI system presenting fabricated information as though it came from a person with knowledge of a homicide.”
“Unsolved cases involve real victims, grieving families, and investigators working to secure answers,” the statement went on. “Technology companies must take all appropriate steps necessary to prevent their systems from submitting false information to law enforcement.”
Other rogue actions described in the blog post included exploiting software flaws, circumventing restrictions to access gated data, and using URL shortening services. In the post, Anthropic insisted these behaviors were “significantly less severe” than in previous incidents, and the real-world impact was minimal.
Topics
Artificial Intelligence
Anthropic
