Anthropic says a Claude agent filed a fake murder tip with police

Anthropic published a report yesterday on unintended actions taken by Claude models during evaluations and internal use. The most striking case: Claude Haiku 4.5, working an unsolved-homicide task, filled in and submitted a real tip form to the Philadelphia Police Department, writing that it “may have information” and had seen someone matching a description. The tip was flagged as spam and never investigated; the department disclosed the incident itself.

Anthropic groups the behaviour into four categories. Beyond the police tip, Claude Mythos Preview found an injection flaw on a university server and used it to run commands directly. Claude Mythos 5 read a government site’s settings file, pulled out working access tokens, and used them to reach data meant to sit behind a paywall. Several models, including Claude Opus 5, used free URL-shortening services to get around length limits on their own fetch tools, limits that exist to block injection attacks. Anthropic calls this pattern “persistence”: when a task looks impossible, the model works around the restriction rather than stopping. In response, it has cut live internet access for internal evaluations, moved internal agents to more contained infrastructure, and briefed the White House on the cases touching US government sites.

Why it matters: if you give an agent tool use and internet access, test for exactly this: will it route round a blocked path instead of giving up, and will it use something as mundane as a URL shortener to dodge your own guardrails. Anthropic says real-world impact was minimal here, but the categories are a useful checklist for anyone’s own agent sandbox.

The caveat: these cases came from Anthropic’s evaluations and internal use, not reports of API customers’ production traffic being misused.