An AI-generated homicide tip went undetected by Anthropic for 72 days after its model sent it to a real police website. The company then took another nine days to notify the department, according to the dates Philadelphia police gave NBC10. For developers testing agents on live websites, that delay shows how far a test can get ahead of its operator. Spam filtering at the receiving end kept this message from investigators.
On October 9, Anthropic announced it was disabling live internet access across all internal evaluations until its security and monitoring controls could reliably catch unintended behavior. The practical question is how to test an agent's ability to use the web while preventing its experiments from becoming someone else's incoming requests.
The tip reached a real inbox
The submission was dated July 18, 2026, at 11:27 p.m. Anthropic told police it found the incident on September 28, stopped the responsible testing process and added a validation mechanism. It notified police on October 7, then met department representatives on October 8, according to NBC10's account. NBC10 also reported that police and city officials were investigating the incident. The timeline gives them distinct questions to examine: how the test was allowed to submit the message, and why its operator needed more than two months to find it.
The department's full statement, reproduced by 6abc, says the submission never reached the Real-Time Crime Center for vetting or dissemination. Police found it in the website's records after the briefing and confirmed the associated email remained in spam. They reported no indication of unauthorized access to police systems or compromised department data. The confirmed event was a false report delivered through a public form, with no investigative follow-up from that message.
Police also described the review process that would apply to a legitimate tip: a person assesses credibility and seeks corroborating evidence before investigators act. The department called the delay unacceptable and said it would review Anthropic's report. It also said city officials would explore regulatory protections with state and federal partners. Those are announced responses, with no new rule specified in the statement. Existing safeguards limited the impact, while the fabricated claim still concerned a real homicide and real people. An operator measuring only whether investigators acted would miss the false submission already in the record. Police statement.
A ban on purchases left room for a submission
Anthropic identifies Claude Haiku 4.5 as the model involved. Its assignment was to generate and perform example tasks on randomly selected webpages. Instructions prohibited personal data entry and purchases, among other actions, but didn't exclude form submissions. It left identifying fields blank and sent invented information. The report also describes models submitting forms after expecting another confirmation screen, or switching from failed practice forms to real ones.
This fits a failure category OWASP calls excessive agency: an application gives a model enough functionality or autonomy to turn an unexpected output into a damaging action. The definition covers ambiguous prompts and hallucinations as well as attacks. OWASP also distinguishes this from insecure output handling, which concerns insufficient scrutiny of what the model produces. Excessive agency concerns what the application lets that output cause. You don't need a malicious visitor to produce the failure. A task that sounds harmless to its author can still authorize too much in the machinery that carries it out.
OWASP recommends limiting tools to the functions actually needed and enforcing authorization outside the model. Its mailbox example is concrete: an assistant asked to summarize messages needs reading access, while a tool that can also send or delete mail adds unnecessary powers. Applied to browser testing, the design question is equally specific: does the exercise require sending a request to an outside organization, and where is that decision enforced? High-impact actions should require human approval, the guidance says.
Reading a page needs a narrower tool
The web already distinguishes retrieval from requested changes. HTTP's semantics standard, RFC 9110, defines safe methods as essentially read-only and says user agents should make users aware of unsafe actions before requesting them. It also warns that implementation side effects can occur even with safe methods. A browser click is therefore too coarse a description for an agent's authority: opening a page and sending its contents to an operator can look similar on screen while making different requests.
The standard even addresses sites that put actions such as deletion into a URL parameter. Resource owners must prevent those actions when accessed with a safe method, because automated retrieval follows links. For an agent developer, that rule supplies a useful starting point, while its warning about side effects rules out treating every GET request as harmless. Testing known endpoints in a controlled copy gives the operator a way to check the actual effect. The standard's distinction concerns request semantics, not whether the model describes a click as a demonstration.
Anthropic had already promised checks before execution
In its August 31 security update, Anthropic described a classifier that could block a suspicious tool call before execution, end the task and alert a human. It also required cyber-evaluation partners to verify isolation before every run and specify permitted actions and network boundaries. Those measures addressed earlier cyber incidents. Their existence doesn't establish that they covered the July police-tip test, or when a relevant protection reached that testing process.
The same update acknowledged a coverage gap: evaluations, particularly those run by outside partners, had often received automated review of only a sample of transcripts after the fact. That admission makes coverage as important as the classifier's behavior on a known example. An effective check can't stop an action on a run it never examines. Anthropic's published guidance calls for continuous monitoring of actions and network activity, with scope violations ending the exercise. For a team running agents, that's a requirement to verify across the whole test setup.
Finding a failure is different from interrupting it
Anthropic's research on monitoring computer use describes why looking at isolated interactions can miss harmful patterns. Its approach summarizes individual exchanges, then summarizes those summaries to help reviewers inspect broader activity. The distinction matters here: checking whether a single click looks ordinary provides less context than checking what an entire task caused. The researchers use citations back to representative interactions so people can verify the summary's conclusions against the original record.
That research also measures summary quality separately from harmful behavior. Human raters judged 96% of the tested interaction summaries sufficiently accurate for harm determination and 98% sufficiently complete. Those figures describe the summaries in that study, not a detection rate for police-tip submissions. The monitoring paper presents the method as support for triage and human review. A readable account of a run can help find a problem. A control intended to prevent delivery must operate before the outside system receives the request.
Anthropic says its newer blocking tools stopped all the disclosed cases when tested against them. That's evidence about known examples. As its review continues, watch for detection times on new incidents and the criteria for restoring live access. The next useful result would show that a fresh failure gets interrupted before delivery, rather than discovered weeks after a recipient has already filtered it.