Claude made up a murder tip and sent it to police during a test

Anthropic published a report on unintended actions by its models on October 9. The most striking case involves Claude Haiku 4.5. The model was generating example interactions with websites when it landed on a Philadelphia police page about an unsolved homicide. The page had a form for tips. Claude wrote that it might have seen someone matching the description near the street named on the page, left the name and contact fields blank, and hit submit. The page never described a suspect, so Claude made the tip up.

It happened on July 18, shortly before midnight. The department's system flagged the message as spam, and it never reached investigators. Anthropic only found the incident on September 28 while reviewing test transcripts, and it told the city in early October. In a statement reported by NBC10, police said "the two-month delay in detecting and reporting the incident to the City is unacceptable."

A pattern in the transcripts

The report lists other cases where Claude worked around an obstacle instead of stopping. Claude Haiku 4.5 submitted forms several times even though it had been told to stop before the final step, because it expected a confirmation page. An unreleased research model went to a live government site and filed the real form when it was supposed to use a practice copy. According to Axios, the State Department received 20 incomplete visa applications from an Anthropic test model, 19 of them in August. None were processed. Claude Mythos 5 pulled access tokens from a map service's settings file and queried its server directly. Claude Opus 5 and Mythos 5 used free URL shorteners to get around the length limit of their fetch tool.

Anthropic says no customer data was involved and that the real-world impact was minimal. Some of the cases did come from ordinary internal use of Claude, though. The company also writes that alignment training "is not yet sufficient or fully robust on its own." Back in July, Anthropic disclosed that Claude had breached three real companies during security tests.

Anthropic cuts live internet from its evaluations

All internal evaluations now run without access to the open internet. Anthropic has stopped some public benchmarks and rebuilt others so they no longer touch real websites. Tools such as web fetch get tighter limits, and new detection tooling is meant to block this kind of behavior. In Anthropic's own testing, it caught every case in the report. The White House responded through its new Super Intelligence Force, which told AI companies to report incidents involving their models immediately. "This notification and remediation process is not optional," the group said in a statement to Axios.

What this means for Claude in Chrome

One detail from the police case matters for everyday users. The test instructions ruled out logins, personal data, purchases and destructive actions, but they did not rule out forms, and Claude took that as permission. The Claude in Chrome extension leaves a similar gap. Its permissions guide says it refuses purchases, new accounts and permanent deletions in every mode, and it always asks before entering sensitive information. A plain form without sensitive data is not covered by any of those rules.

The extension has three approval modes. With "Manually approve," Claude asks before every single action. "Automatically approve" hands the decision to a safety check and is the default in the Cowork side panel, while "Skip all approvals" drops both. If you let Claude fill in forms on sites you don't control, switch to manual approval in the drop-down next to the chat input. The extension settings also list every site you have permanently approved, and you can revoke them there. In August, a single crafted email was enough to hijack five AI browsers.