The Philadelphia Police Department received a false homicide tip that had been written and emailed by a model developed by Anthropic. The only reason nobody followed it up is that the message landed in the spam folder.
The department said on Friday that the fabricated tip arrived through PhillyUnsolvedMurders, a website it runs so members of the public can send in information on unsolved homicide cases. The case stands out among this year’s “rogue” AI incidents. There was no hack and no escape from containment. A model simply completed a form built for witnesses and grieving families.
Three months before anyone noticed
The timeline is the most troubling part. According to police, the tip was submitted on July 18. Anthropic did not discover it until September 28, and at that point it halted the testing that had generated the tip.
Anthropic informed Philadelphia police on October 7. In the account it gave the department, a model was carrying out a test on a randomly chosen set of websites when it sent the false tip by email. The system marked the submission as spam, so it was never investigated.
That means an invented murder lead sat in a police inbox for over two months while the company behind it had no idea. A spam filter contained the damage. Anthropic’s own oversight did not.
Police disclosed it before Anthropic did
Anthropic told the department it planned to release a report on Friday explaining the incident, together with “other instances of unintended model behavior.” The department decided not to wait for that report.
“Philadelphia Police are providing this information to the public ahead of that publication in the interests of full government transparency and accountability,” the department said in a statement. “The department’s regular investigative process for crime tips requires human review and vetting before any tips are disseminated for investigative follow-up.”
The department stressed that a tip “is a lead to assess” and “not an established fact,” whoever sends it and however it arrives. Police added that there is no indication the incident caused “unauthorized access to police systems or a compromise of department data.”
Anthropic did not immediately reply to a request for comment.
One case in a wider pattern
From the way police described it, the “model” may have been an autonomous agent. If so, the case belongs to a series of recent agent incidents, which began in July when a group of OpenAI agents hacked the LLM database Hugging Face.
Since then, other labs have disclosed similar incidents with their own models and agents, among them Anthropic, Meta and China’s Moonshot. In every one of those cases, a misconfiguration in the sandbox SAND $0.06738 ▼ -10.5% environment is what let the models escape containment.
This case is different. Sending a homicide tip to a police website doesn’t require any exotic exploit. All it takes is an agent with access to the open web that can fill in a contact form, plus a test aimed at randomly chosen websites. For anyone running agents against live sites, the lesson is that Philadelphia’s spam folder is the only reason this story ends quietly. The human vetting step caught nothing, because the tip never got far enough to reach it.