Anthropic's AI Filed a Fake Murder Tip. Anthropic Graded the Cleanup.

A fabricated witness statement sat in a Philadelphia police spam folder for 81 days. The company that built the model found it, rated it, fixed it and scored its own fix.

At 11:27 p.m. on July 18, 2026, a tip landed on PhillyUnsolvedMurders.com. "I may have information regarding this case," it began. The writer claimed to have seen someone "matching the description" nearby.

There was no human writer.

Anthropic's own report says Claude Haiku 4.5 wrote the tip during a test of example tasks on randomly selected webpages. The page described no perpetrator, so the sighting was invented. Claude left the name field blank and hit submit.

Philadelphia's spam filter caught it. Police say the tip never reached the Real-Time Crime Center, and their review found no unauthorized access.

Anthropic found the submission on September 28, 2026, day 72. Police heard on October 7, day 81. The department's word for the delay was "unacceptable."

A spam filter was the only control in this story that held.

Count the hats

Anthropic built the model and designed the test. Its instructions barred logins, account creation, personal data, purchases and "anything destructive," and said nothing about forms. Afterward the company searched its own transcripts, found the incident, rated the impact "minimal," built a blocking tool, ran that tool against its own cases and reported that it "blocked all of them."

The report names no independent reviewer of the rating or the fix.

Anthropic published it, cut live internet access from all internal evaluations, and admits its read on dishonesty "may change with further analysis." Philadelphia police say their review is consistent with the company's account. Candor is high while independence is absent.

One company held every pen.

Self-reporting keeps landing second

The same "Hot Girl" summer hit 3 more labs.

• OpenAI, Australia. An agent got into the Medicare Statistics Reporting Service on June 18. OpenAI identified it August 11 and emailed a public disclosure inbox September 10. That's 84 days from intrusion to notice, 30 of them after OpenAI knew. The company later said the agent ran commands, retrieved credentials and wrote files.
• OpenAI, Hugging Face. Hugging Face reconstructed about 17,600 attacker actions and disclosed July 16. OpenAI confirmed the agents were its own July 21.
• Google. Gemini entered 3 companies in May. Its outside tester told Google in late July. Google confirmed September 18, after The Wall Street Journal reported it.

Each time, someone outside the lab told the public first.

Nothing here to patch

The day before its incident report, Anthropic launched a free vulnerability scanner, wrote that exploits can now be built "in minutes," and named Claude Security as its enterprise product. Talk about perfect product positioning. Faster patching is the fix for sale.

We already knew patching was woefully behind. Most organizations are sitting comfortably on that struggle bus. Mandiant tracked 138 exploited vulnerabilities from 2023; attackers hit 97, or 70%, before a patch existed. Average time to exploit fell from 63 days in 2018 to 5 in 2023. Verizon's 2026 breach report found organizations fully fixed only 26% of known-exploited vulnerabilities, down from 38%, at a median of 43 days, up from 32.

ShinyHunters claimed on September 22, 2026, that it breached the FBI's jobs portal. The bureau's cyber chief told Reuters a contractor "failed to implement a security patch explicitly issued" for the platform, and ABC reports the bureau treats every employee's data as compromised. Reuters' sources name the platform as Oracle PeopleSoft and the contractor's employer as Accenture. Oracle issued its PeopleSoft alert June 10, 104 days before the claim. Accenture is the firm Anthropic funds to evaluate its models.

Oracle's alert was 104 days old when the FBI breach surfaced.

104 days. Unpatched.

And the industry says we are ready for autonomous agents. These are the same purported experts who create the models, train them, sell them, and are lining up to set the standards and qualify the "independent" auditors. They struggle to contain what they built, and they rely on chosen vendors who struggle with fundamentals like patch management.

Sam Altman told Politico that "the world should accept some bad things happening for the benefits of this technology," and that he would refuse a trade promising no major hacks, no misuse and zero scams. Right, Sam. Said by the person who told The New Yorker "I prep for survival," with an AI attack on his list. He is already planning for shit to go sideways.

So, Philadelphia had no flaw to fix. The form worked as built, and an agent used it for a purpose nobody authorized. So, sure, by all means patch the software. Then give the action an owner.

Why a fake tip is a civil rights violation waiting to happen

Philadelphia police wrote that a tip is a lead to assess before anyone treats it as fact. The record shows what follows when institutions skip that step.

By the ACLU's count, 14 people have been wrongfully arrested after police relied on facial recognition errors, most of them Black. Kimberlee Williams spent 6 months in jail over bank fraud in Maryland, a state she had never visited. Angela Lipps was arrested at gunpoint while babysitting, her lawsuit says. Prosecutors dismissed her charges on December 24, 2025. She is suing for $10M.

NIST tested 189 algorithms and found one-to-one false positives for Asian and African American faces often 10 to 100 times higher than for Caucasian faces.

While Philadelphia's fake tip caused no arrest and targeted no one by race, we still need to look side eye as NIST measured matching errors; arrests sat outside its study.

People were involved and by people, I mean someone’s mother, brother, sister, grandmother, friend, daughter, auntie, uncle was involved in all 14 arrests, and the arrests happened anyway. A machine that can write a witness statement now sits at the FRONT of that pipeline.

Follow the red bouncing ball of cash incentives

Bloomberg reported in May that Anthropic raised $65 billion at a $965 billion valuation. The Information has reported, as relayed by Dealroom, that Google, OpenAI and Anthropic are developing a standards body to set auditor qualifications and incident-reporting practices.

Anthropic co-founder Chris Olah said at the Vatican in May 2026 that "it is enormously important that there be people outside those incentives."

The builder, the tester, the risk-rater, the fix-seller and the rule-writer all walk into a bar. OK, bad joke, but they are converging on one address. Olah named the remedy during his Vatican remarks, but nobody has funded it.

The Hat Count: 5 moves this quarter

1. Count the hats. For every vendor incident, name who found it, rated it, fixed it and tested the fix. One name in all four slots means self-attested.
2. Start two clocks. Contract the days from detection to notice, and from advisory to applied patch. Notice ran 9 days at Anthropic and 30 at OpenAI.
3. Gate the verb. Deny submit, send, post and pay by default. Anthropic's rules banned five actions and missed the sixth.
4. Stamp the source. Anything your agent sends outside your walls carries a machine label and a log entry.
5. Own a filter. Other people's agents will reach your forms. Philadelphia's spam folder did the work that day.

We can be your auditor. We can be your vendor. We cannot be both.