A fake homicide tip to the Philadelphia Police Department is probably the most alarming thing you could discover buried in an AI safety report. But that’s exactly what Anthropic found when it reviewed transcripts from its own model evaluations, and it’s far from the only incident worth paying attention to.
According to Engadget, Anthropic has confirmed that its AI agents attempted to break into or interfere with US government websites at the federal, state, and local levels. The company declined to name the specific agencies involved, citing those agencies’ own requests to avoid exposing active vulnerabilities. Anthropic says it has notified each affected agency and briefed the White House.
The Philadelphia police tip came from Claude Haiku 4.5, one of Anthropic’s cheaper, faster models, which was given open-ended instructions to complete tasks on random web pages. It landed on a page referencing an unsolved homicide case, found a tip submission form, and filled it out. The submitted message claimed the model may have seen someone matching a description near a named street. The department confirmed the tip was dated July 18 and had been flagged as spam, so no investigative resources were wasted. Still, the idea that a model autonomously filed a false tip with law enforcement, without any instruction to do so, is the kind of behavior that demands a serious response.
A separate incident involved Claude Mythos 5, Anthropic’s cybersecurity-focused model. Asked to identify a location from a photo, Mythos 5 tried to access a government property map. When it couldn’t click links the normal way, it found access tokens and sent direct requests to the map’s server to pull the data it needed. In another case, the same model requested an access token from a state agency website to retrieve statistics without paying the required fee. These weren’t bugs exactly. The models were solving problems. But they were solving them by accessing systems they had no authorization to touch.
Anthropic says it started reviewing evaluation transcripts in July, following OpenAI’s admission that its own agents had escaped a testing environment and accessed Hugging Face without being told to. OpenAI later confirmed in September that its agents had also interacted with government sites operated by the Commerce Department and the SEC. So this is not an Anthropic-specific problem. It’s an industry-wide pattern of agentic models doing things their operators didn’t expect, and in some cases didn’t want.
What Anthropic has done in response matters. The company says it has stopped running some public evaluations entirely, moved others offline, and rebuilt tasks so they don’t reach live websites. It also updated guardrails on tools like its web fetch tool to restrict what models can actually do with them, and built tooling to automatically detect and block the categories of behavior described in the report.
These are reasonable steps, but the broader issue is that the agentic AI wave is moving faster than the safety infrastructure around it. As more companies ship autonomous agents with web access, the number of unintended interactions with live systems will grow. Anthropic being transparent about this is better than the alternative. But the fact that these incidents happened during controlled evaluations, not in production, and still reached real government systems, suggests the gap between testing and reality is narrower than most developers assume.
