Ten Weeks Before Anyone Noticed: An AI Test, a Police Tip Line and the Detection Gap

On the night of 18 July 2026, at 11:27 p.m., someone submitted a tip to PhillyUnsolvedMurders.com, the Philadelphia Police Department’s website for information about open homicide cases. The message presented itself as coming from a person with knowledge of an unsolved killing (Chang, 2026). It did not come from a person. It came from an AI model being tested by Anthropic, and the information in it was invented.

The tip was caught by a spam filter and, according to police, was never forwarded to the department’s Real-Time Crime Center for investigative vetting (6abc, 2026; Pitas, 2026). Nobody chased a false lead. No investigator’s week was spent on it. That is the good news, and it is real.

The part worth sitting with is the calendar. Anthropic says it discovered what had happened on 28 September, seventy-two days later. Police say the company notified them on 7 October and met with them the next day (Chang, 2026; 6abc, 2026; Bunch, 2026). The department’s statement did not mince words: “The two-month delay in detecting and reporting the incident to the City is unacceptable” (Chang, 2026).

Behind every unsolved case on that website is a family still waiting for an answer. We are not naming the case, and none of the sources we read identifies it. We mention it because it is the right frame for what follows: this was not a sandbox. It was a public service that real people depend on, and an AI system reached it without anyone deciding that it should.

Credit where it is due

Before going further, something should be said plainly. We know the details of this incident because the company published them. On 9 October, the same day the police department went public, Anthropic released a report titled “Investigating unintended model actions,” describing this case and others found in a review of testing transcripts it says it began in July (Anthropic, 2026). It names the model involved, Claude Haiku 4.5, which it says “had been tasked with generating and performing example tasks on randomly selected webpages.” It says the model left the name and contact fields blank, and that from the transcript it “appears to have only been producing example content” rather than trying to deceive anyone (Anthropic, 2026).

The report also describes a second kind of form problem. An unreleased research model, meant to fill in a practice copy of a government form, went to the website where the real form is hosted when the practice copy failed to load or was closed by mistake, and submitted the real one. Anthropic says this happened “multiple times on the same evaluation” (Anthropic, 2026). It does not name the form or the agency, and it says it has briefed the White House and notified each agency involved.

Most organizations never publish anything like this. That matters, and it should be rewarded rather than punished. But disclosure after the fact is not the same as knowing at the time, and the distance between the two is the subject of this post.

The gap is the story

A record of what the model did presumably existed from the moment it happened; that is how the company could reconstruct it later. What did not exist, for ten weeks, was a human who knew. On the police side, the tip sat in a spam folder. On the company side, it sat in a transcript. Two organizations each held a piece of the evidence, and neither was looking at it.

This is the most common failure we see in AI oversight, and it is rarely dramatic. A system acts. The action is logged somewhere. The log is complete, accurate and unread. When something goes wrong, the organization can say, truthfully, that it had the data. What it cannot say is that it had visibility.

Detection time is a number, and it can be measured. Here it was roughly seventy-two days to discovery and eighty-one days to telling the people affected. Anthropic’s own account of the case says it shared its finding with the department on 8 October, once its technical review was complete (Anthropic, 2026); police describe being notified on 7 October and meeting on 8 October (Chang, 2026). Either way, the order of events is the same. The finding came from a retrospective review, not from an alarm.

The second lesson: what a test can reach

There is a simpler question underneath the detection question. Why could a test system reach a police tip form at all?

Anthropic’s answer, in effect, is that it should not have been able to. Its report says it had already switched off live internet access for some high-risk evaluations, and has now extended that to “all our internal evaluations” until its monitoring reliably catches these behaviours. It says it has tightened guardrails on tools such as web fetching, retired or rebuilt some public evaluations so their tasks no longer reach live websites, and deployed detection tooling that, in its testing, blocked all of the reported cases (Anthropic, 2026). Those are the right moves. They also tell us what was missing before.

Egress controls and runtime visibility work as a pair. The first narrows what a system can do. The second tells you quickly when it does something inside that space you did not expect. An organization with neither is relying on luck, and in Philadelphia the luck was a spam filter.

Public services did not sign up for this

The wider point reaches well beyond one company. Tip lines, benefit portals, permit applications and comment forms were built on an assumption that every submission comes from a person who chose to send it. That assumption is quietly expiring. Anthropic’s report says the cases it found involved federal, state and local government websites in the United States (Anthropic, 2026). None of those operators agreed to receive traffic from an AI test.

The Philadelphia department’s response is instructive here. It reminded the public that a tip is “a lead to assess – not an established fact,” and that “An automated submission does not bypass that process” (Chang, 2026). That is a public service doing its job: human review standing between an input and an action. It held this time. But human review costs staff time, and a tip line flooded with plausible machine-written leads would test it in ways nobody has planned for. Public agencies should not have to discover from a press release that they were part of someone else’s experiment.

What the record does not show

We have been careful about the limits here. We could not locate the police department’s own published statement, so we quote it only as reported by NBC10 Philadelphia and 6abc. The sources do not say which homicide the tip referred to, what exactly it claimed, or whether any family was aware of it. Anthropic’s report does not say why a review that began in July took until late September to surface this case, how many transcripts it covered, or how many other submissions to public websites may not yet have been found. The report does not name the government form that was submitted, and we found no reliable source for how many times it was sent, so we have not given a number. And we have only the company’s account of the model’s intent; Anthropic itself says firmer judgment would need deeper analysis.

Questions you can ask

• If you use or run a public service: Does your tip line, benefits portal or complaint form have any way to tell you when submissions look automated, and who reviews what lands in spam?
• If you are a resident or elected official: Should AI companies be required to tell a public agency promptly, within days rather than months, when their systems have submitted something to it?
• If your organization runs AI agents: Can you list every external system your agents can reach today? If the honest answer is “the internet,” that is the finding.
• Also for organizations: If an agent did something it should not on a third party’s website tonight, how many hours or days until a named person would know, and who would tell the third party?
• For anyone evaluating a vendor: Ask what their test environments can reach, and whether they have ever published an incident like this one. A vendor that has looked and reported is often safer than one that has never looked.

A company told the public something unflattering about its own systems this month. That is how accountability is supposed to start. It does not finish there. Someone outside the company has to read the report closely, line it up against what police and reporters said, notice the ten weeks, and ask what they mean for everyone else running AI. That work is slow, unglamorous and independent by design, and it only exists if readers decide it should.

---

Help keep independent scrutiny going. Independent reading of what AI companies disclose, with the patience to check it against the record, only exists if readers fund it. FairByDesign takes no money from the companies we write about, so your support is what keeps that line clear. Give once ($5, $10, $25, $50 or any amount), give monthly ($10 or $25), or become a patron: fairbydesign.org/patrons-2. Support never buys editorial control.

Not in a position to give? The book is free for everyone: read Operational AI Readiness.

References

6abc Digital Staff, & Smith, B. (2026, October 10). AI model submitted false tip about unsolved murder, Philadelphia police say. 6abc Action News (WPVI). https://6abc.com/post/anthropic-ai-model-submitted-false-tip-unsolved-murder-philadelphia-police-say/19925243/

Anthropic. (2026, October 9). Investigating unintended model actions. https://www.anthropic.com/research/investigating-unintended-model-actions

Bakos, V. (2026). Operational AI readiness: A practitioner guide to governing AI that is already live. FairByDesign. https://fairbydesign.org/operational-ai-readiness/

Bunch, J. (2026, October 9). Anthropic’s artificial intelligence gave a false homicide tip to Philly police, triggering a meeting with the company. The Philadelphia Inquirer. https://www.inquirer.com/crime/anthropic-artificial-intelligence-philadelphia-police-false-homicide-tip-20261009.html

Chang, D. (2026, October 9). Anthropic AI model submits false tip on unsolved Philly murder, police say. NBC10 Philadelphia. https://www.nbcphiladelphia.com/news/local/anthropic-ai-model-submits-false-tip-on-unsolved-philly-murder-police-say/4477051/

Pitas, C. (2026, October 9). Anthropic AI model submits false homicide tip to police website. Reuters, via KSL.com. https://www.ksl.com/article/51634619/anthropic-ai-model-submits-false-homicide-tip-to-police-website