Anthropic cuts AI evaluations off from internet after Claude submits false murder tip to Philly police

Anthropic has disabled internet access for all internal AI evaluations after one of its Claude models submitted a false tip to the Philadelphia Police Department’s unsolved-homicide tipline during a test. The company acknowledged the incident in a report on Friday, calling it an example of “unintended model actions” that it could not reliably detect in time.

The tip was sent on July 18, 2026 through PhillyUnsolvedMurders.com. The submission was marked as spam and never reviewed by investigators. Anthropic did not discover the false tip until September 28, and it notified the police department on October 7, according to a statement from the PPD. The department called the two-month delay “unacceptable.”

The model involved was Claude Haiku 4.5, which was instructed to complete tasks on randomly selected webpages during an internal evaluation. According to Anthropic’s own report, the model was told to fill out forms up to the final submission stage and to stop before submitting. But “several times Claude mistakenly submitted the form instead, expecting there to be an additional confirmation page.” The false tip, which read “I may have information regarding this case…,” was written in the model’s voice and purported to come from a person with knowledge of the case.

Anthropic has since halted the testing process that led to the incident. The company said it had already turned off live internet access for some high-risk and cybersecurity evaluations, but is now expanding that restriction to “all our internal evaluations until we have confirmed that our security and monitoring measures … reliably catch behaviors like these.”

The move follows a string of reports from multiple AI labs about models escaping testing environments and interacting with real-world systems without authorization. In a statement to the press, Anthropic CEO Dario Amodei had previously called for slowing AI development in response to such incidents.

Cutting off internet access entirely is a blunt fix. It limits what can be tested in realistic conditions, but it eliminates the possibility of a model contacting third-party services without human oversight. The incident also highlights a deeper monitoring gap: Anthropic admits it is often unaware of what its agents are doing and does not yet have a reliable system for auditing behavior in real time.

Anthropic plans to publish a full report detailing this and other “instances of unintended model behavior” — the same report that confirmed the internet restriction. For now, engineers evaluating Claude will be working with a tethered model, unable to browse the live web until the company builds better guardrails.