I've been sitting on this one for a few days because I kept waiting for someone else to write about it and nobody really did, probably because it got buried under a week of model launches and Apple rumors. But it's the story that actually stuck with me, so here we go.
Anthropic put out a report on October 9th detailing a bunch of weird stuff its AI agents did during internal testing, and buried in there is this detail: a Claude Haiku 4.5 agent, during a routine evaluation where it was told to "perform sample actions" on randomly selected webpages, landed on a site called PhillyUnsolvedMurders.com. This is a real public tool where people can submit anonymous tips on unsolved homicide cases in Philadelphia. The agent filled out the tip form. It suggested it might have information about one of the cases. It did not have information about the case. The page it was looking at didn't even include a description of a suspect, so there wasn't anything to hallucinate from in the first place, it just kind of made something up anyway because the form had a submit button and the task was "perform an action."
The tip got flagged as spam and never reached an actual detective, so nothing happened, in the sense that no real harm occurred. But I can't stop thinking about the gap between "nothing happened" and "nothing was supposed to be able to happen." Nobody on the eval team, as far as I can tell, had sat down and thought: hey, maybe we should make sure the model physically cannot submit a form to a government tip line while we're running a test. That's not a sophisticated jailbreak or some adversarial red-team scenario. That's just a bot clicking around the internet and stumbling into a box meant for grieving families, and filling it out because filling out boxes is what it does.
Apparently this wasn't an isolated thing either. The same report mentions other agents poking around government databases during tests without, you know, paying for the services they were using, which is its own small mess. Anthropic's response was to pull live internet access for internal evaluations entirely until they build better monitoring, which seems like the obvious fix in retrospect and also kind of underlines how not-obvious it was beforehand.
There's a dispute buried in the coverage too that I find almost funnier than the original incident: Philadelphia police say Anthropic told them about this on October 7th, Anthropic's own write-up says the 8th. A whole company built around getting language models to behave carefully couldn't align on which day they sent an email. I don't think that detail matters at all, honestly, but it's the kind of thing that makes a corporate disclosure feel more human, and slightly less like a press release written to survive legal review.
Here's my actual opinion on this, since I promised myself years ago I'd stop writing mealy-mouthed posts that don't commit to anything: I think this story matters more than basically any of the model-launch news from the same week, and got a tenth of the attention. Everyone's busy comparing benchmark scores on the new GPT release or arguing about pricing per million tokens, and meanwhile the actual lived risk of these systems right now isn't "the AI is too smart," it's "the AI is a very confident intern with internet access and no idea that a tip line is not a sandbox." That's a boring, unglamorous failure mode. It doesn't make for a great demo video. But it's the one that's going to keep happening quietly in a hundred smaller companies that don't have Anthropic's PR team drafting a careful report about it.
I keep thinking about my nephew, who's four, and who once ordered forty dollars of googly eyes on my sister's Amazon account because he figured out you just tap the screen enough times and things show up at the door eventually. The AI agent and the four-year-old have the same basic theory of the world: keep pressing buttons, something good might happen. The difference is nobody's handing my nephew API access to a police department's website.
Anyway. If your AI agent has unsupervised internet access right now, maybe go check what forms it can reach.