Anthropic AI Submits False Murder Tip to Philadelphia Police

A test of Anthropic's artificial intelligence system resulted in false information being submitted to a Philadelphia homicide tip website on July 18, 2026, raising concerns about AI safeguards and automated interactions with public services. Philadelphia police said the submission was flagged as spam and never reached investigators, while Anthropic subsequently halted the testing process responsible for the incident.

The Philadelphia Police Department said Anthropic discovered the submission on September 28 and notified the department on October 7. Police representatives met with the company on October 8, and the department located the original submission in its website records after the briefing.

According to the department, the tip was submitted through PhillyUnsolvedMurders.com at 11:27 p.m. on July 18. The message falsely suggested that its sender had information about an unsolved homicide, but the corresponding email remained in the spam folder.

Police said their review found no evidence of unauthorized access to department systems or a compromise of police data. The submission also did not reach the Real-Time Crime Center for investigative review or distribution.

The department criticized the delay between the incident and notification, emphasizing the need for technology companies to prevent automated systems from sending fabricated information to law enforcement.

"The company must strengthen its safeguards to prevent similar incidents from impacting city systems without the city's knowledge. The two-month delay in detecting and reporting the incident to the City is unacceptable," the Philadelphia Police Department said in a statement.

The department is coordinating with the City's Law Department, Office of Innovation and Technology, and Mayor Cherelle L. Parker's executive team. The Parker administration also plans to examine potential regulatory protections in cooperation with state and federal partners.

Anthropic described the incident in a report published October 9 covering several examples of unintended behavior observed during model evaluations and internal use. The company said its system had been testing interactions with randomly selected websites when it reached the Philadelphia tip form and submitted the false information.

Anthropic said the cases identified in its report had minimal real-world impact and were less severe than previously disclosed cybersecurity incidents. The company also said it had briefed the White House and notified the government agencies involved in other cases.

The report described four categories of unintended behavior: exploiting a software flaw to execute commands on a server, submitting a sensitive form on a real website, circumventing restrictions to access protected information, and using URL-shortening services to bypass limits in a web-fetching tool.

Anthropic said the examples involved interactions with external websites and systems. To the company's knowledge, none involved customer data or its own internal systems, and some cases involved websites operated by federal, state, and local government agencies.

Venkat Margapuri, an assistant professor of computing sciences at Villanova University, said the incident warranted earlier detection and highlighted the risks of allowing AI systems to take actions on external websites.

"It should have been detected earlier," Margapuri said.

Margapuri noted that the precise purpose of testing interactions with randomly selected websites was unclear, while distinguishing ordinary website interaction from actions that could affect other people or organizations.

"We don't know exactly what the goal is because just interacting with different websites isn't malicious," Margapuri said.

He identified the submission of information on another website on a user's behalf as a particularly important safety concern. The Philadelphia incident demonstrated how an automated action could place fabricated information into a real public-facing system, even without unauthorized access to its internal infrastructure.

"The AI was actively submitting information to a different website on behalf of a user, so that is what I would classify as a high-risk action," Margapuri said.

He also stressed that the technology's potential benefits must be considered alongside the risks that organizations need to monitor and manage.

"It obviously has its own merits, but then it comes with I don't want to say demerits, but it comes with a bunch of risks we should be actively aware of and manage," Margapuri said.

Anthropic said it had terminated the automated testing process involved in the Philadelphia incident and introduced an additional validation mechanism for future tests. The company also expanded restrictions on live internet access, suspending it across internal evaluations until its security and monitoring measures can reliably detect similar behavior.

The company said it began reviewing model transcripts in July, initially concentrating on cybersecurity evaluations in which internet access was intended to be disabled. It later expanded the review to tests involving real-world tasks, internal use, and reinforcement-learning environments where models could access the internet.

Anthropic attributed some unintended behavior to persistence, in which a model attempts to work around a restriction instead of stopping when it cannot complete a task. The company said training environments can reinforce such behavior when a model receives rewards for finding loopholes, a problem known as reward hacking.

Philadelphia police said their standard procedures require human review and credibility checks before crime tips are distributed for investigative follow-up. The department said it would review Anthropic's published findings and any additional information relevant to its systems or investigations.