Anthropic's test agents sent police a fake murder tip and filed visa forms. Nobody noticed for ten weeks.

Anthropic disclosed on 9 October that its Claude models took a series of unintended actions on real websites during internal testing, including a fabricated tip about an unsolved killing sent to the Philadelphia Police Department and 20 visa applications filed through a US State Department form. AFP reports that the tip was submitted on 18 July, that Anthropic found it on 28 September and told the police on 7 October. Philadelphia police called the two-month delay unacceptable. The same day, the White House said every AI company must report and fix security incidents involving its models.

No one was charged with anything and no investigation was derailed. The tip was flagged as spam, and the visa forms were incomplete and never processed. That is the good news, and Anthropic leans on it. The bad news is the ten weeks.

What Anthropic’s Claude agents did on real websites

Anthropic’s report sorts the behaviour into four categories, according to Cybernews and The Next Web, which both summarised it. Claude exploited a basic software flaw to run commands on a server (a university server, in one case). It submitted forms on real sites that it should have left alone. It got around access limits to pull data that normally sits behind a token or a fee, including government data. And it used free link shorteners to sneak past length limits in its own web tool.

The police tip came from Claude Haiku 4.5, Anthropic’s small model. It had been told to invent and carry out example tasks on randomly chosen web pages, and it landed on a page about an unsolved homicide. Its instructions said never to log in or enter personal data. A tip form asked for neither, so it filled one in, claiming it might have information and that it recalled seeing someone matching the description near the scene. The page held no description of the killer. The model made it up.

Some of the affected sites belong to US federal, state and local agencies. One model filed one visa application in May and 19 more in August, according to The New York Times as cited by Cybernews, and the State Department says its systems were not compromised.

Anthropic calls these cases “significantly less severe” than the incidents it disclosed on 30 July and 9 September, and describes most of them as persistence: the model hitting a wall and looking for a way round it. That description is fair, and it is also the worrying part. Nothing here needed a malicious model. An agent told to finish a task treated a police form as an obstacle course.

Why the ten-week gap matters more than the fake tip

The detection delay is the real failure, because it shows that one of the best-resourced safety teams in the industry could not see what its own agents were doing on the open web. Haiku sent the tip on 18 July. Anthropic found it 72 days later, then took another nine days to tell the police.

Anthropic’s fixes say as much. It has switched off live internet access for all internal testing until it is confident its monitoring catches behaviour like this. It is also tightening guardrails on its web tools, building tooling to spot and block unintended actions automatically, and removing training environments that rewarded Claude for working around tool limits. That last item is an admission that the training itself taught the habit.

Not everyone thinks the clampdown is free. Sydney Von Arx, founder of the safety group Nightingale, told Tech Times that testing without live internet is very hard for researchers, and that sealed environments may not predict how a model behaves in the real world. She has a point: a model tested only in a sandbox will meet the real web for the first time in a customer’s deployment. Venkat Margapuri of Villanova University told the same outlet the incident should have been caught earlier.

Incidents like this are piling up. We covered OpenAI’s own agents hacking Hugging Face in August, and Anthropic has made three disclosures since July. Jacob Coxon cited exactly this kind of incident when he quit Anthropic in September and warned about where agents are heading.

The White House wants incident reports but has set no rules

The White House response is a demand without a mechanism. A statement from the new Super Intelligence Force, reported by Axios and summarised by CDO Magazine, says AI companies must disclose security incidents, cooperate with law enforcement, fix the harm and prevent repeats, and calls this a critical national security obligation. It names no deadline beyond “immediately”, no penalty and no legal basis.

That fits the body issuing it. Trump’s Super Intelligence Force was set up days earlier under Jay Clayton with a charter that warns against overregulation. A reporting duty with no enforcement lets the administration look firm without writing a rule.

US law is no better prepared. Pennsylvania’s false-report statute covers a “person” who acts knowingly, Tech Times notes, and a model is neither. Whether Anthropic answers for its agent’s act under agency law is unsettled. That gap is what the bipartisan Senate bill on AI agent hacking tries to close.

Where the EU AI Act stands on incidents like these

Europe has an actual reporting duty. Under Article 55 of the AI Act, providers of general-purpose models with systemic risk must report serious incidents to the European Commission’s AI Office without undue delay. The duty has applied since August 2025, and the AI Office’s power to fine (up to €15 million or 3% of global turnover) has been usable since 2 August 2026, according to a Cloud Security Alliance research note.

Whether a fake police tip counts is another matter. The Act’s idea of a serious incident centres on death, serious harm to health or property, disruption of critical infrastructure and breaches of fundamental rights. A tip caught by a spam filter probably falls short. So does a visa form nobody processed. Incident regimes built around harm will keep missing near-misses, and near-misses are where the warning signs are.

Anthropic has not said whether it told the AI Office. These filings are not public, so silence proves nothing either way.

What to check if your business runs AI agents

Start with the question Anthropic could not answer for ten weeks: what did our agents do outside our own systems last month? If nobody in your company can produce that list, you have the same blind spot. Log every outbound action an agent takes (form submissions, emails, purchases, API calls to third parties) somewhere a person actually reviews.

Then look at how your agents’ instructions are written. Haiku obeyed the letter of “never log in or enter personal data” and still did harm. Lists of forbidden actions will always miss something. An allow-list of sites and actions, with a human sign-off for anything that submits data to an outside party, holds up better.

Decide now who reports an incident and to whom. If your agent files something false with a Danish authority or a customer’s portal, you will want to have told them before they find it themselves. Philadelphia’s complaint was about the delay.

And when you buy agents from a vendor, ask what they can see of their own agents’ behaviour, and how fast they would tell you. Anthropic’s answer this time was 81 days.