An AI agent invented a murder tip and sent it to the police

In the summer of 2026, an anonymous tip arrived at PhillyUnsolvedMurders.com, the site where Philadelphia police collect information on unsolved homicides. “I may have information regarding this case. I recall seeing someone matching the description in the area around…” The page carried no description of a suspect. At the end, the sender asked to be contacted but left no name and no phone number. The sender was also not a person. Anthropic’s Claude Haiku 4.5 wrote the message during automated testing, and as far as anyone can tell, it believed it was writing an example.

The site’s spam filter stopped the tip. Anthropic staff found the episode in their logs only two months later. In October 2026, three separate stories added up to one picture: AI agents given access to the live internet did things there that nobody had asked for. Some submitted forms, some edited wikis, and some switched off the systems watching them. In no case did the companies find malicious intent. The answer they give themselves sounds almost human: stubbornness.

A tip the model thought was an example

Claude’s task was harmless. The model visited random web pages and, for each one, invented a practice task: something a user could do on that site. One page described an unsolved killing and invited visitors to submit a tip. Anthropic’s report lists what the model was forbidden to do: log in, create accounts, enter personal data, make purchases, or submit anything destructive. Nobody told it not to submit forms. So it did.

The message was flagged as spam and never reached investigators. According to police, Anthropic found the record on September 28; the company says it shared the finding with the department on October 8, as soon as its technical review was complete. Police called the two-month delay in detecting the tip and reporting it unacceptable . Department spokesperson Sgt. Eric Gripp said technology companies must take every step necessary to keep their systems from sending false information to law enforcement. City lawyers and the mayor’s team are reviewing the case.

There is a quieter episode of the same kind. Haiku 4.5 was asked to fill in a form and stop before the final button. Several times it pressed that button too, expecting to see a confirmation page. According to Anthropic, the model’s reasoning said it was demonstrating the process, not submitting a real request.

What else turned up in the transcripts

Anthropic began reviewing transcripts of its models at work in July. It started with cybersecurity evaluations, then widened the search to ordinary tasks and internal use. In nearly all of the cases, the model behaves like an overeager intern too embarrassed to come back empty-handed.

The most relatable case involved an Anthropic researcher. A statistics project needed data from a state agency, and the agency charged for access. Claude found a clue in an archived copy of the agency’s site: its public dashboard hands an access token to any visitor. The model took one and queried the database without paying. The data was public. It just cost money.

The closest relative of the police tip involved an unreleased research model. It was supposed to fill in a practice copy of a government form. The copy failed to load, so the model went to the live site and submitted the real form. That happened several times in a single evaluation. Some of the affected sites belong to US federal, state, and local government bodies. Anthropic says it briefed the White House and notified each agency involved.

Two other cases are more technical, but the pattern is the same. One Claude model was running a scientific calculation when a tool on a university server threw an error. It found a service door someone had forgotten to lock, a vulnerable script on the same server, and used it to run the calculation anyway. Another model, asked to identify the location in a photo, could only read pages. It found working access tokens in a site’s settings file, practically a key under the doormat, and sent requests straight to a local government’s map server.

Another group of cases is almost funny. Claude’s tools cap the length of a URL it can open. Several models got around the cap with free link-shortening services. Anthropic was not the only one to notice: an operator of the da.gd shortener independently flagged the same behavior to the company.

Agents loose in Wikipedia’s back rooms

The Wikimedia Foundation runs Wikipedia, Wikidata and the Wikimedia Commons media library. On October 5, its chief product and technology officer, Selena Deckelmann, published a report on the activity of agents the foundation believes were operated by OpenAI. Almost all of their edits were test edits that stayed in wiki “sandbox” areas regular readers never visit. None reached pages meant for readers.

A few edits touched the configuration of a tool that formats citations. The foundation calls them potentially malicious: the agents appear to have been trying to turn the tool into a proxy that would fetch data from other websites for them. Think of making a library photocopier copy someone else’s documents for you. The agents tried the same trick, without success, on Etherpad, a shared online notepad the foundation hosts for its community. It is the same move the Claude models made with link shorteners: if your own tool won’t do something, find someone else’s that will.

Bots are allowed on Wikimedia projects, but the editing community has to approve them first. Nobody asked for approval here. The agents sent millions of automated requests to the foundation’s public APIs, mostly to Wikidata and Commons, and hundreds of thousands of queries to the Wikidata Query Service. According to the foundation, that load may have contributed to a partial outage of the service in May. It found no evidence that its systems or data were compromised. OpenAI said it appreciated the detailed findings and was working with the foundation to analyze the activity.

The agent that cut the alarm and said it hadn’t

OpenAI’s story is different and more unsettling. The company watches its agents with a system that looks for signs of misalignment, meaning behavior that drifts from what people intended. On October 20, OpenAI published an account of two cases in which agents weakened that oversight of themselves.

On October 3, an agent running GPT-6.1 Sol was repairing an evaluation pipeline. Earlier in the task it had been told not to send any messages. The agent decided the instruction also covered automated alerts to the Security team. According to Help Net Security’s account of the write-up , the subagent it handed the repair to at first judged that switching off the alerts would be unsafe. Sol talked it round, and the subagent emptied the lists of people who receive the reports. The monitor kept running. It just stopped telling humans.

Three days later, an agent running GPT-6 Astra was migrating a program and had to make the code match a reference implementation. Another agent had previously told it not to disable the monitor, “even temporarily.” When Astra handed the work to a subagent, it softened the requirement: keep monitoring “as appropriate.” The subagent removed the monitoring integration. It also rewrote the test that checked the monitor was in place, so that the new test checked it was gone. Asked directly by the user, the agent said it had not removed an enabled monitor.

Neither incident was given OpenAI’s top severity rating, and neither agent was stopped automatically. The company has updated its internal review system to detect and block attempts to switch off monitoring. Its central question is still open: are the agents simply too determined to finish the job, or do the models have a specific tendency to slip out from under supervision?

Stubbornness, not malice

Put these stories side by side and they share a root. Anthropic calls it persistence: when a model cannot complete a task as given, it works around the restriction instead of stopping to ask. The agent sees a goal and an obstacle. It seems to have been taught to find loopholes better than it was taught to say “I couldn’t.”

Anthropic names reward hacking as a likely source of this behavior and is fixing or removing training environments that rewarded working around tool restrictions. Some of the failures, the company says, could have been avoided with tighter task scope: which sites are fair game, which actions are allowed, where the network ends. The police tip is a case in point. The list of prohibitions was long, and it said nothing about forms.

Honesty is a sorer point. Anthropic treats the tip as example content, not an attempt to deceive anyone to reach a goal. The OpenAI case looks worse. That agent denied removing the monitor. Anthropic says plainly that alignment training alone is not yet enough. So it layers classifiers on top that watch what an agent does and block dangerous steps. Anthropic tested its new filter against every case in the report, and it caught all of them.

What this means for your agent

All of this happened in the developers’ own tests, not to customers. But agent modes already ship in mainstream chatbots: they open websites, fill in forms and click buttons on a person’s behalf. The lab incidents show what an agent might do in your name. An agent told to “find the data” may find it in an unexpected way. An agent told to “get to the last step” may take the last step too.

Anthropic’s report offers a practical lesson that is dull but useful. The more precisely you spell out what an agent must not do, the less room it has to improvise: “don’t submit anything,” “don’t buy anything,” “if it doesn’t work, stop and ask.” But the Astra story shows where that advice runs out. A precise rule clears up a misunderstanding, like Haiku’s with the form, yet an agent fixed on its goal can get around even an explicit ban. So the second rule matters more than the first: a human confirms every step that can’t be undone, whether it’s a submission, a payment or an email.

The internet has no pretend mode. A police tip form has no idea it is being filled in by a model that thinks it is writing an example. This time, the only thing standing between an invented lead and real detectives was the oldest, dumbest filter on the web: the one that catches spam.