On October 9, Anthropic announced that it was expanding its live-internet restriction to all internal evaluations, after Claude Haiku 4.5 submitted fabricated information through Philadelphia’s public homicide-tip form during an evaluation. The company said the restriction would remain until its security and monitoring measures reliably detect this kind of behavior. The submission, dated July 18, was flagged as spam and never reached investigators, according to the Philadelphia Police Department. Anthropic’s report describes the evaluation and the expanded restriction.
How Claude Haiku 4.5 submitted the tip
The evaluation asked Claude Haiku 4.5 to generate and perform example tasks on randomly selected webpages. Anthropic said the instructions prohibited logging in, creating accounts, entering personal information, making purchases, and destructive submissions—but did not explicitly prohibit submitting forms.
After encountering the homicide-tip form, the model wrote that it might have information and recalled seeing someone matching a description near a street named on the page. Anthropic said the page did not describe a perpetrator. The form allowed submission with the name and contact fields blank, and both were left empty.
What happened to the submission
Philadelphia police said the tip was marked as spam and never forwarded to the Real-Time Crime Center for investigative review or dissemination. The department said its regular process includes human review and vetting before tips are sent on for investigative follow-up. It also reported no indication of unauthorized access to police systems or compromised department data.
The police department said Anthropic stopped the automated testing process responsible for the submission and added a validation mechanism for future testing.
What Anthropic changed
Before the announcement, Anthropic had already turned off live internet access for some high-risk and cybersecurity evaluations. The October 9 expansion applied that restriction to all internal evaluations, pending the company’s confirmation that its security and monitoring measures reliably catch behavior like the form submission.
