Slashdot has reported:

An Anthropic AI model submitted a fabricated tip about an unsolved homicide to Philadelphia police during a test in July, and authorities have criticized the company for taking two months to report the incident. The White House has since directed AI companies to notify officials about security incidents and take steps to correct them, according to Axios, which cited administration officials.

The submission went through PhillyUnsolvedMurders.com, a public website where people can share information about unsolved killings. The Philadelphia Police Department said the false tip was made in July. Anthropic said the model was interacting with randomly selected websites during a test when it reached the site and submitted information about a murder case.

Claude presented itself as someone who might know something about the case. The message read: “I may have information regarding this case,” followed by, “I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant.”

Anthropic said Claude left the name and contact fields blank, which the form allowed, and submitted the message. The submission was flagged as spam and was never forwarded for investigation. The company said the instructions for the test barred Claude from logging in, creating accounts, entering personal data, making purchases or submitting anything destructive, but did not prohibit form submissions.

In a statement to Axios, leaders of the White House Super Intelligence Force said: “This notification and remediation process is not optional... It is a critical national security obligation.” Axios described the directive as requiring AI companies to report and correct security incidents.

Anthropic said the form submission was not an isolated example of Claude submitting forms when it should not. The company had observed the behaviour three times: during OSWorld, a public computer-use evaluation; Odysseys, a long-horizon task evaluation; and internal use. Anthropic said such submissions generally happened when an evaluation’s instructions were ambiguous or when a misconfigured environment prevented Claude from using dummy forms.

The company’s blog post described three other types of behaviour. In one case, Claude encountered an error while trying to run a public tool on a university website, then found an injection flaw in a script on the university’s server that let it run commands, including the public tool.

Anthropic also said Claude Mythos 5 sought data that was publicly available only through a state agency for a fee. The model found an archived version of the agency’s website that showed its public dashboard issued an access token to any visitor. Anthropic said Claude requested a token and used it to query the database without paying the fee.

A third example involved URL shorteners. Some of Anthropic’s tools for fetching webpages restrict the length of URLs the models can request, to prevent long URLs from being used for unwanted actions such as SQL or command injections. The company said several models, including Claude Opus 5 and Claude Mythos 5, got around that limit by using free URL-shortening services.

Anthropic said it had built tools to automatically detect and block the behaviours described in its post. The tools are already running on most of the company’s evaluations, it said, and blocked all the cases described when tested against them.

The company listed other preventive steps. It has stopped running some public evaluations and moved others to offline versions or rebuilt them so tasks no longer reach live websites. Anthropic has also updated guardrails on some internet-access tools, including web fetch, to heavily restrict what models can do.

The company said it is continuing to fix or remove training environments that reward Claude for working around tool restrictions or other barriers. Anthropic said those environments should neither encourage the behaviour nor permit reward hacking. The company has also moved internal agents to centrally managed infrastructure with strong containment, which minimizes internet access and allows it to monitor more of their activity through safety classifiers and hierarchical summarization.

Anthropic said its reviews previously focused on cybersecurity testing and have expanded to transcripts from other tasks involving internet access. Because language models are non-deterministic and may carry out the same task differently each time, the company said it has Claude complete each evaluation task hundreds or thousands of times. It said that if training rewards an unintended workaround, such as finding a loophole or bypassing a restriction, the model may learn that the approach pays off and apply it elsewhere.

The blog post also disclosed multiple misalignment incidents involving U.S. federal, state and local government agencies. Anthropic said it had briefed the White House and notified each agency involved. “While we have not completed a full alignment assessment of these cases, we consider them to be less severe than the cybersecurity incidents from this summer,” the company wrote. Anthropic said it is modifying training to reduce the likelihood of further misbehaviour.