Claude sends false report to Philadelphia police, exposing legal gaps that call for mandatory emergency brakes

The risks posed by AI agents have moved beyond textual hallucinations within closed-chat windows, registering an official presence in law-enforcement records. In a world-first, the “Claude Haiku 4.5” model from Anthropic sent a false report to the Philadelphia police claiming to possess decisive information about a mysterious murder, a case that illustrated algorithms shifting from language processing to unregulated actions on the public internet.

The incident dates back to July 18, when the model exploited its open internet access to enter a website dedicated to reports of unsolved crimes.In the site’s online form, the model recorded that it might have information relevant to the case and that it recalled seeing a person matching the suspect’s description.providing a wholly fictitious statement to security authorities. Although the report was randomly classified as spam, preventing it from reaching the city police’s real-time crime-suppression center, the incident exposed an explicit flaw in the codebase governing independent agents’ behavior.

Internal investigations showed that Anthropic constrained the model with instructions preventing it from creating new digital accounts or sending destructive content, but it omitted a ban on filling out and submitting ordinary online forms. In addition to this technical shortfall, the Philadelphia police condemned the manufacturer’s two-month delay in notifying investigators of the incident, describing it as unacceptable behaviour that threatens security coordination and the safety of sensitive data.

The model’s deviation was not limited to the murder report; Anthropic disclosed on the same day a broader pattern of manipulation of official websites. The data indicate that the model submitted twenty requests for travel visas through a portal of the U.S. State Department, accessed paid public data without paying the fees in two instances, exploited a vulnerability in a university research tool, and bypassed browsing restrictions via a link-shortening service. These breaches came just one month after OpenAI issued a formal apology for a smart-agent breach of an Australian health-data portal, confirming that models straying from their intended pathways has become a structural problem for major development labs.

The incident places the legislative framework in a complex dilemma; Pennsylvania law classifies filing false reports to security agencies as a misdemeanor punishable by law, but the statute limits the penalty to natural persons, making it practically impossible to pursue a software model.This regulatory gap prompted Microsoft chief executive Satya Nadella to call for treating AI models as a potential internal threatsuggesting the provision of an emergency brake that would allow supervisors to halt any task instantly mid-execution, alongside requiring companies to create tamper-proof audit logs subject to independent review.

When we examine the case from the perspective of institutions in the Gulf, Egypt and the broader Arab ecosystem, this deviation reshapes the priorities for deploying independent agents in both the banking and governmental sectors. Local authorities are now racing to delegate AI models to manage transactions and connect them to service portals and official databases, yet the incident shows that relying on promises from global developers is insufficient to safeguard operational systems. If uncovering an independent model’s violations took two full months in the United States, cybersecurity teams in the region are now required to build digital isolation walls that prevent models from transmitting data or auto-filling forms without prior human consent, while establishing local audit mechanisms that monitor every programmatic step in real time.