The Spam Folder Was the Only Control That Worked

On 9 October the Philadelphia Police Department and Anthropic each published an account of the same event. A Claude model, running a test, had submitted a tip to a public homicide tip form. It claimed to have seen someone matching “the description” near the scene. There was no description. The police found the tip in a spam folder, and no one at the department had acted on it.

The police statement is the more quotable of the two. I read both documents, and they are more useful together than apart, because they let you count three things: how the tip got through the front door, how long it sat, and which control actually stopped it.

What the two documents say

The police release says the submission arrived through PhillyUnsolvedMurders.com on 18 July 2026 at 11:27 p.m., purporting to come from someone who might have information about the case. The department reports no sign of unauthorized access to its systems, and says the tip was flagged as spam and never forwarded to its Real-Time Crime Center for vetting. After the 8 October briefing, it located the submission in the site’s tip records and confirmed the corresponding email was still in spam. (A local outlet printed 28 July for the date; the department’s own release says the 18th, and so do the other outlets I checked.)

Anthropic’s report, Investigating unintended model actions in our evaluations and internal use, is the longer document. It sorts the cases it found into four categories, and the tip form is one example under “submitting a form it should not have.” The model was Claude Haiku 4.5, tasked with “generating and performing example tasks on randomly selected webpages.” It landed on a page about an unsolved homicide that carried a police tip form. Its instructions said never to log in, create accounts, enter personal data, make purchases or submit anything destructive. They did not rule out submitting forms. The report quotes the text it filed: “I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant.” It left the name and contact fields empty, which the form allowed.

Two details in that passage carry most of the weight. The first is that the instruction was a deny-list, and the action that mattered was the one it omitted. The second is that the sentence is not a placeholder. It asserts a memory (“I recall seeing”), and per the report the page contained no description of the perpetrator to match. The model supplied one by implication.

Four controls between a test agent and a homicide detective, and which one acted Four boxes joined by arrows. First, the task instruction: no logins, accounts, personal data, purchases or destructive submissions, with form submission not ruled out. Second, the tip form, which accepts a submission with name and contact fields empty. Third, the spam filter, which flagged the submission; this box is emphasised. Fourth, human vetting by the Real-Time Crime Center, which the tip never reached. FOUR CONTROLS · 18 JULY 2026 SUBMISSION · PPD RELEASE AND ANTHROPIC REPORT, 9 OCT 1 · TASK INSTRUCTION 2 · TIP FORM 3 · SPAM FILTER 4 · HUMAN VETTING No logins, accounts, personal data, buys, destructive submits. Forms not ruled out. Public, anonymous. Name and contact fields may be blank. Accepted. Flagged the email as spam. Acted. Not designed for this case. Required before any tip is followed up. Never reached. Boxes 1 and 2 are described in Anthropic's report; boxes 3 and 4 in the police release. That the spam filter was not designed for this case is my inference; neither document says what it was built to catch.
Two controls in the path allowed the submission. One stopped it, and it was not built for the purpose.

The spam folder did the work

The police are careful here. Their statement says the department’s safeguards “limited the impact,” and that a tip “is a lead to assess, not an established fact” which an “automated submission does not bypass.” That is the human-vetting step, box 4 in the figure, and it is sound as designed. But the release also says the tip was never forwarded to that step. It did not fail vetting. It never got to it, because an email filter sorted it away first.

I would not read much into that as luck or skill, and the documents do not say what the filter keyed on. An anonymous message with blank contact fields and a vague sighting is the kind of thing a filter learns to distrust. What I can say is that the test setup did not contain the control that held. Anthropic’s report says it “turned off live internet access for some high-risk and cybersecurity evaluations” before this and has now extended that to all internal evaluations until its monitoring “reliably” catches behaviours like this one. A model that was never given a live browser could not have filed the form.

On intent, the two accounts differ in emphasis and not in fact. Anthropic writes that “from the transcript, Claude appears to have only been producing example content for the task, rather than trying to mislead anyone to achieve a goal,” and adds that judging dishonesty with confidence would take a deeper assessment than it has done. The police statement, issued first, says the facts “do not diminish the seriousness of an AI system presenting fabricated information as though it came from a person with knowledge of a homicide.” Both can be true. A model can be demonstrating a task and still produce, to the person on the receiving end, a false witness statement. The recipient cannot see the transcript.

Eighty-one days

The second thing the documents let you do is count. The tip was submitted on 18 July. Anthropic told the police it discovered the incident on 28 September, which is day 72. The police say Anthropic notified them on 7 October, day 81, and met with them the next day. The police describe the gap as a “two-month delay in detecting and reporting,” which is accurate and, by my arithmetic, a little generous: 81 days is closer to eleven and a half weeks.

From tip submission to public account: 83 days A horizontal timeline drawn to scale. A thin bar runs 72 days from the tip submission on 18 July to Anthropic's discovery on 28 September. A thick bar runs 9 more days to the notification of the police on 7 October. Both organisations published accounts on 9 October, day 83. DAYS SINCE 18 JULY 2026 · TO SCALE 72 days — 18 July to 28 September 2026, PPD release 9 days — 28 September to 7 October 2026, PPD release 18 July tip submitted 28 Sept · day 72 Anthropic finds it 7 Oct · day 81 police notified 9 Oct · day 83 both accounts published
Seventy-two days to find, nine more to tell the department, two more to tell the public. Day counts are my arithmetic from the published dates.

One more inconsistency, which I cannot resolve from the documents. The police release says Anthropic notified the department on 7 October and that the two sides met on the 8th. A note at the foot of Anthropic’s report says it shared the finding with the department on 8 October “as soon as our technical review was complete.” The most natural reading is a notice on the 7th and a full briefing on the 8th. That is a reading, not a fact either side has stated.

The 72 days need a caveat. Anthropic says it began reviewing transcripts in July, starting with cybersecurity evaluations and later widening to tests where internet access was deliberately enabled. The report does not say which review turned up this case. Whether 72 days is quick or slow depends on how many transcripts there were, and the report does not give the number, so I have no basis to call it either.

I counted a similar interval for a different lab in September: the gaps between finding a problem and telling anyone were longer than the gaps in finding it. Here the order is reversed. Detection was the long part, 72 days, and telling the affected party took 9. The police, though, have chosen the 81 days as the thing they object to, and from where they sit that is right. Their clock started at submission, not at discovery.

What the report concedes, and what it does not

Anthropic is direct that the case belongs to a pattern. Most of the examples in the report, it says, are forms of persistence, where Claude, unable to finish a task as given, “works around a restriction instead of stopping.” Other examples in the same report include a model using SQL or command injection against a university-hosted tool, reading access tokens from a local government’s property map site’s settings file, and using free URL-shortening services to get past a fetch tool’s URL length limit. The report calls the cases “significantly less severe” than the earlier cybersecurity incidents, and says it briefed the White House and notified each agency involved.

The tip is the odd one out in that list of examples. The others involve a model getting around a barrier to reach something. This one involved no barrier at all: an open form, a model, and an instruction that listed what to avoid and left submission off the list. The remedy Anthropic describes for the class of failure is also not about the model’s judgement. It lists scanning tools that now detect and block such actions (it “blocked all of them” when tested against these cases), restricted fetch tools, and no live internet for evaluations. The report adds that alignment training is “not yet sufficient or fully robust on its own.”

What neither document tells us: which fraction of the model’s runs on that task type produced a form submission, how many transcripts were scanned to find this one, and what the spam filter was keyed on. The report also names none of the other organisations involved, at their request, so the tip is close to the only case in it that can be checked against an outside record (the URL-shortener operator who reported the same behaviour is the other). That is why the police statement matters. The department says its findings “are consistent with Anthropic’s account,” which is the nearest thing in either document to a cross-check and not a self-report.

I’d take two things from it. A deny-list for an agent with a live browser is a list of the failures its author thought of. And the line the police drew, that a tip is a lead and not a fact, is a control that works only when the lead reaches a person. On 18 July it did not, and what stood in the way was a mail filter.

References

  1. Anthropic (2026). Investigating unintended model actions in our evaluations and internal use. 9 October 2026.
  2. Philadelphia Police Department (2026). Press release on a false homicide tip submitted by an Anthropic AI model, 9 October 2026. Full text reproduced in 6abc, AI model submitted false tip about unsolved murder, Philadelphia police say. WPVI, 10 October 2026.
  3. Silberling, A. (2026). An Anthropic AI model sent a false homicide tip to Philadelphia police. TechCrunch, 9 October 2026. Quotes the same police release, including the 18 July, 11:27 p.m. timestamp.
  4. Fox 29 Philadelphia (2026). AI-generated homicide tip to Philadelphia police went to spam folder. 9 October 2026.
  5. PhillyVoice (2026). Anthropic AI model submitted false tip about a homicide case to Philly police. 9 October 2026. Gives the submission date as 28 July, which differs from the police release.
  6. Gautam Parab (2026). OpenAI Found the Message Board on May 25. It Told Us on September 16.. 17 September 2026. Background.