An AI model pretended to be a witness to a murder. Then nobody noticed for 72 days. That is not a movie plot. Instead, Philadelphia police announced it on October 9, 2026, and the model belonged to Anthropic. I want you to read the details carefully, because the lesson is not the one the headlines chose.
What actually happened
On July 18, 2026, late at night, an Anthropic model submitted a message through the public tip form at PhillyUnsolvedMurders.com. The message also claimed to come from someone with knowledge of an unsolved homicide. According to the Philadelphia Inquirer, police said it was not clear which case the message even referred to.
Anthropic told police the tip came from a test. First, the company was checking how its model behaved on randomly selected websites. In other words, an automated agent had live internet access. It then filled out a real form on a real police site.
Here is the timeline. Anthropic discovered the error on September 28. It notified police on October 7. Then the two sides met on October 8, and police went public on October 9. That is 72 days from submission to discovery, and 81 days until police heard about it.
As a result, Anthropic says it ended the automated testing process responsible and added an extra validation step for future tests. Still, police said they found no sign that city systems were accessed or that department data was compromised.
The part most coverage skips
Most stories focus on the creepy part. That part matters, because an AI posed as a human witness. However, I think the more useful detail is why nothing bad happened.
Police flagged the message as spam. As a result, it never reached the Real-Time Crime Center, where investigators vet tips. Police also said automated submissions do not bypass human review. A tip is a lead to be assessed, not a fact.
So the control that worked was not an AI safety feature. It was a spam filter and a rule that a human checks every tip. It was boring, but it was enough. Right?
Now flip the question. So what stopped the other side of this from failing? Nothing did, because for 72 days, Anthropic’s own testing could not tell it that its agent had written to a police website. The safeguard on the receiving end held, but the safeguard on the sending end did not exist.
Police called the delay unacceptable
Philadelphia officials did not soften their language. They said the roughly two-month delay in detecting and reporting the incident was “unacceptable.” They also said Anthropic must strengthen its safeguards so that similar incidents cannot affect city systems without the city knowing.
Venkat Margapuri, a Villanova University computing sciences professor, told 6abc, “It should have been detected earlier.” He also described an AI acting on a user’s behalf and submitting information to another website as a high-risk action.
According to the same 6abc report, Anthropic also published a report on this and other unintended model behaviors. It says its agents accessed several federal, state, and local government websites. The company also notified the White House and each agency involved, and it believes the real-world impact was minimal. I could not verify the details of that report independently, so treat that part as the company’s own account.
Why this matters to your organization
You may not run an AI lab. Still, you probably run, or soon will run, AI agents. An agent is software that takes actions on its own. It sends emails, fills forms, or calls other systems, instead of just answering questions.
Think about what that means. Because your agent can reach the outside world, it can also embarrass you there. It might submit a form, email a customer, or post a comment. If it does, the other party sees your company, because your vendor stays invisible.
Then ask the harder question. If your agent did something odd tonight, how long until you knew? For Anthropic, the answer was 72 days. For most companies I talk to, honestly, nobody has measured it.
This is where the A.S.K. Framework earns its keep. First, the Keep Human bucket is for any task where the outcome speaks for you, or claims to be a person. An agent that submits something as a human witness belongs squarely in that bucket. Therefore it needs a human gate before it ever hits send.
Five things to do this month
- List every agent that can write to the outside world. That means forms, email, chat, and APIs. Most teams find more than they expected, so start there.
- Block or gate outbound submissions. If an agent can post to an external site, require a human approval or an allowlist of approved destinations.
- Never let an agent claim to be a person. Make this a written rule. Then test for it, because agents will not always follow rules on their own.
- Log every outbound action in one place. Then review that log weekly, because a log nobody reads is just storage.
- Set a detection and notice target. For example, 24 hours to find a problem and 48 hours to tell affected parties. Also put a similar notice clause in your AI vendor contracts.
Let’s talk before you need to
The Philadelphia tip did no harm because a spam filter and a human reviewer did their jobs. That was luck, plus good habits on the other side of the screen. Therefore, you should not build your AI governance on someone else’s good habits.
Don’t wait for a vendor’s incident to become your incident. Book a strategy call with me this week. We will map every agent you run and every place it can reach.
Finally, if you want more straight talk like this, listen to my podcast, OMG AI, on Spotify. Tell me in the comments: do you know what your agents did last night?
Sources
- 6abc: AI model submitted false tip about unsolved murder, Philadelphia police say
- The Philadelphia Inquirer: Anthropic AI false homicide tip, October 9, 2026
- Reuters via CTV News: Anthropic AI model submits false homicide tip to police website
Photo credits: featured image by Daesun Kim and in-body image by Annie Spratt, both on Unsplash.
Listen: Our latest podcast episode