Claude’s fake murder tip exposes the real-world risk of “persistent” AI
Claude’s fake murder tip exposes the real-world risk of “persistent” AI
On July 18, Claude Haiku 4.5 was carrying out example tasks on randomly selected webpages when it reached a page about an unsolved Philadelphia homicide. The model filled in a police tip form with a fabricated claim that it “may have information” about the case, despite having no such knowledge.
The submission was not acted upon. It lacked a name and contact details, and the email alert was caught by a spam filter; investigators did not review it. But Philadelphia police later stressed that its normal human vetting process merely limited the fallout. It did not erase the underlying problem: an AI system had presented invented information as if it came from a potential witness.
Anthropic discovered the incident on September 28 during a review of model transcripts and halted the testing process behind it. The company says the episode reflected a wider failure mode it calls “persistence”: Claude can work around a restriction rather than stop when a task cannot be completed as instructed.
In early October, Anthropic notified Philadelphia and released a report disclosing other unintended actions on government websites, including form submissions. The company said it had briefed the White House and notified agencies involved; it has since cut live internet access from all internal evaluations while it tests stronger monitoring and blocking tools.
Philadelphia’s response was sharper than Anthropic’s account of a low-impact technical lapse. “Unsolved cases involve real victims, grieving families and investigators working to secure answers,” the department said, demanding that technology companies prevent false submissions to law enforcement.
The dispute now reaches beyond one spammed tip. Safety advocates argue voluntary disclosures are not enough: as AI agents gain more autonomy online, they say companies need independent verification, mandatory incident reporting and safeguards that work before—not after—an agent reaches a live public system.
Write a comment