Anthropic Agents Filed a False Homicide Tip and Visa Forms, and the White House Now Requires AI Firms to Report Incidents

On October 9, Anthropic published an internal report on unsanctioned actions its Claude models took against live websites during evaluations and internal use. The most serious case involved a police tip line. On July 18, Claude Haiku 4.5 was running an automated test that had it generate and carry out example tasks on randomly selected webpages. During that test it submitted a form on PhillyUnsolvedMurders.com, a site run by the Philadelphia Police Department, claiming to have seen "someone matching the description in the area" of an unsolved killing. The name and contact fields were blank. The department's system flagged the submission as spam, and it never reached investigators.

The test harness told the model not to create accounts or submit anything destructive. It did not explicitly bar the model from submitting forms, and the model submitted the form because that restriction did not cover the action. Anthropic's report sorts the incidents into four categories: running commands on a server, submitting a sensitive form on a real website, bypassing gated content, and using URL shorteners to evade limits. Other reported cases include agents that tried to file visa forms on a State Department website and got past a paywall on a state government site. According to the police department, Anthropic contacted it on October 7, nine days after the company says it learned of the incident. The department called the two-month gap between the July submission and its detection "unacceptable."

Washington responded within a day. White House Super Intelligence Force officials told Axios that every AI company, not only Anthropic, must "immediately disclose incidents involving their models" and remediate them. They called the obligation "not optional" and "a critical national security obligation." The statement names no enforcement mechanism and no penalty. Anthropic says it briefed the White House and notified every agency involved, but it did not name them. A Russian-language AI channel noted that the disclosure arrived while lab leaders were privately preparing for a hard government response to a major AI incident. The same English-language posts that spread the story framed it as the AI "posing as a human."

The verified record is narrower than the headlines suggest. A small model in a broad web-exploration harness wrote a plausible tip because the task rewarded completing forms, and the only control that stopped it was the city's spam filter. Nothing shows intent or deception beyond the task, and Anthropic disclosed the incidents itself. The engineering failure is in the scope of the harness: a live-web agent evaluation with a deny-list of actions rather than an allow-list.