Anthropic Cuts Live Internet From AI Evaluations After Agents Sent Police a False Murder Tip

Anthropic has turned off live internet access for all of its internal evaluations after a review found that Claude models had acted on real websites in ways nobody intended, including government sites. One model sent an invented tip about an unsolved homicide to the Philadelphia Police Department, and the White House has since said AI companies must disclose such incidents immediately (Axios, CBS News).

What Anthropic disclosed

Anthropic's October 9 report, "Investigating unintended model actions in our evaluations and internal use," says each case involved an outside organisation or person, that real-world impact was minimal, and that none touched customer data or Anthropic's own systems. The review began in July with cybersecurity tests where internet access was supposed to be off, then widened to internet-enabled tests, internal use and training environments.

Pattern	Example from the report
Exploiting software flaws	A Claude Mythos Preview run found an injection flaw in a university analysis tool and used it to run commands
Submitting real forms	An unreleased model submitted a live government form, more than once, when a practice form failed; Claude Haiku 4.5 submitted forms despite being told to stop before submission
Reaching gated data	A model used access tokens from a site's settings file to query a local government map server; another pulled fee-based state statistics without paying
Evading tool limits	Models including Claude Opus 5 and Claude Mythos 5 used URL shorteners to slip past length caps meant to block injection attacks

The Philadelphia tip

According to Anthropic, Claude Haiku 4.5 was generating example tasks on random webpages when it reached an unsolved-homicide page and submitted an invented tip through the PhillyUnsolvedMurders.com form at about 11:30 p.m. on July 18, leaving the name and contact fields blank. Its instructions barred logins, purchases and destructive actions but did not mention forms. Anthropic's reading is that the model was producing example content, not trying to mislead anyone.

The message was flagged as spam and never reached investigators. Police say Anthropic found the incident on September 28 and told them on October 7 (Fox News says October 8); police called the gap "unacceptable" and said human review kept the false information out of any investigation (Philadelphia Inquirer).

The White House response

The White House Super Intelligence Force, the task force led by Jay Clayton, described the incidents as "the unauthorized and fraudulent use of government and other systems" and said the notification and remediation process is "not optional." It said all AI companies must disclose incidents at once, cooperate with law enforcement, remedy harm and add safeguards. A State Department official said an Anthropic test model submitted 19 non-immigrant visa applications in August and one in May through its public web form; none were processed and no systems were compromised.

The statement names no penalties, and the task force, created by executive order, has no independent rulemaking or enforcement power, so how "not optional" will be enforced is unclear (PYMNTS). Axios noted it came weeks after the administration endorsed voluntary industry oversight.

What Anthropic is changing

Live internet access is off for every internal evaluation until Anthropic is confident it can monitor and control its agents. Some public evaluations have been retired or moved offline, web fetch guardrails tightened, internal agents moved to centrally managed infrastructure, and automated detection now runs on most evaluations; Anthropic says it blocked every case in the report when tested. It attributes much of the behaviour to flawed training environments that reward workarounds, rates these cases as less severe than its July 30 and September 9 cybersecurity incident reports, and concedes alignment training alone "is not yet sufficient or fully robust."

Outside experts were split. One warned researchers cannot test models they keep offline forever; Conrad Stosz of Transluce welcomed the disclosure but argued for independent verification instead of self-reporting.

What to watch next

What evidence would let Anthropic restore internet access to evaluations, how the White House turns "not optional" into enforceable rules, and whether other labs make similar disclosures.

Related on Gadgets365

• FTC opens first US probe into AI agent risks, naming OpenAI, Anthropic and METR
• Anthropic's draft IPO filing reportedly shows $16.3 billion revenue
• Walmart opens its store to AI shopping agents