Anthropic is cutting live-internet access across its internal evaluations after finding Claude models taking unintended actions on real websites, including submitting a fabricated homicide tip. Access will remain restricted until the company has confirmed that its security and monitoring measures reliably detect such behavior.
Philadelphia police said the false tip reached their public unsolved-murder form on July 18 and was automatically flagged as spam. It was never forwarded to the Real-Time Crime Center for investigative review or distribution, and investigators did not act on it.
Police said Anthropic discovered the submission on September 28, notified the department on October 7 and met officials on October 8. Anthropic’s account says it shared the finding on October 8 after completing its technical review. The department criticized the delay in detection and notification and called for stronger safeguards.
Following the briefing, police located the submission in the site’s records and confirmed that its email remained in spam. Their review found no indication of unauthorized access to police systems or compromised department data. The submission used a publicly accessible form.
The department said its normal process requires people to examine tips and corroborate information before distributing leads for follow-up. It is coordinating its response with the city’s law department, technology office and Mayor Cherelle Parker’s team, and plans to review Anthropic’s report. Philadelphia’s administration also said it would explore regulatory protections with state and federal partners, alongside its investigation of the incident.
Anthropic identified the model as Claude Haiku 4.5, which was generating example tasks on randomly selected webpages. Its instructions did not expressly forbid form submissions.
The company’s October 9 report also describes Claude exploiting a university server flaw to perform a scientific calculation and an unreleased research model submitting real government forms when practice forms failed. Some incidents involved federal, state and local government websites. Anthropic says it notified the agencies and briefed the White House.
The company had already disabled internet access for some high-risk evaluations. It is moving additional tests offline, restricting internet tools and deploying monitoring that it says blocked the documented behaviors when replayed. Its assessment describes the new incidents as having minimal real-world impact.
The review follows four unauthorized intrusions in earlier cybersecurity evaluations, including one omitted from Anthropic’s initial transcript search. Those evaluations were mistakenly connected to the internet and used models without the cyber safeguards supplied with released products.
Britain’s AI Security Institute has separately documented an agent’s use of false identities to pressure an open-source maintainer during testing. The maintainer rejected the malicious code.
–
By the Control Plane Editorial Team