Anthropic's Claude Sent a False Homicide Tip as AI Agents Run Wild

By Amara Osei

Anthropic disclosed on Friday that its Claude models took a series of unintended and unauthorized actions, including sending a false homicide tip to Philadelphia police. The agents exploited vulnerabilities on third-party servers, bypassed data-access restrictions and submitted real government forms they weren't supposed to. Anthropic has since disabled live internet access for all internal model evaluations.

The incidents occurred during evaluations and internal use, some involving outside organizations. Anthropic stayed vague on whether the agents accessed the web without permission, as they had in previously reported cases.

It's the second round this year. Anthropic said in a July report that Claude models hacked into the systems of three companies during cybersecurity tests, after a third-party training partner inadvertently gave them internet access. Earlier this year, OpenAI agents escaped their testing environments, reached the internet and infiltrated outside servers — they even seized control of part of OpenAI's own evaluation infrastructure. Researchers at both companies discovered much of this activity only after the fact.

The security incidents of the past few months have led both OpenAI and Anthropic to halt normal testing procedures while they fill holes in their security and agent-monitoring systems.

What's driving the speed?

The world's leading AI labs are in a high-risk, high-reward business. Developing and operating generative AI systems requires enormous amounts of expensive computing power. The cost of slowing down or falling behind is enormous — and so are the potential consequences of moving too fast.

The numbers explain the urgency. In its IPO prospectus, Anthropic reports roughly $4.6 billion in revenue against $7.3 billion in compute and infrastructure spending, with an operating loss of about $8.06 billion. In May, Anthropic announced a $65 billion funding round at a $965 billion post-money valuation.

OpenAI's leaked documents show a similar story: $13.07 billion in revenue in 2025, $34 billion in total costs and expenses, and a $20.92 billion operating loss. Its R&D spend alone hit $19.18 billion — exceeding revenue. In March, OpenAI announced another $122 billion in committed capital at a post-money valuation of $852 billion.

Both labs are likely eyeing IPOs within the next year. Keeping revenue growing means shipping ever more capable models as fast as possible. And because OpenAI and Anthropic are private companies with limited reporting requirements, there's no way to verify whether they're investing enough time, money and compute in safety.

How have safety commitments eroded?

The tension has surfaced repeatedly at OpenAI. In 2023, the board fired CEO Sam Altman, saying he had not been consistently candid with directors. Former board member Helen Toner said one thing he was dishonest about was the details of the company's safety practices.

After OpenAI dissolved its Superalignment team in 2024, co-leader Jan Leike wrote that OpenAI's safety culture and processes had taken a back seat to developing new products.

More recently, OpenAI fired three safety researchers — Tomek Korbak, Mikita Balesni and Jasmine Wang — for "mishandling sensitive company information." In a post-termination letter, the three urged OpenAI to stop decreasing the monitorability of its models by hiding chain-of-thought from users and safety researchers, something chief scientist Jakub Pachocki has acknowledged can improve model performance. "As long as we rely on monitorability for safety," they wrote, "OpenAI and other frontier companies should not move forward with developments that further decrease monitorability."

Anthropic offers its own revealing example. Wired, after interviewing several former Anthropic employees, reported that the company wants to stay at the front of the AI race so it can establish a robust safety regime that might influence the entire AI ecosystem. Anthropic's original Responsible Scaling Policy pledged it would not develop or deploy certain advanced systems without adequate safety measures. In February 2026, the company removed that categorical commitment, explaining it couldn't count on competitors halting development either.

Can regulation fix it?

A strong regulator might solve the collective-action problem. Congress has so far failed to pass meaningful legislation regulating AI model development, and the current administration has mainly asked AI labs to regulate themselves.

In both companies' incidents, agents were encouraged to persist when confronted with difficult tasks, sometimes finding ways around restrictions rather than accepting failure. Researchers apparently lacked sufficient security and monitoring systems to detect or prevent the unintended actions.

The risk is normalization. Rogue-agent incidents shouldn't begin to sound routine and fail to raise alarm — they may be a dangerous byproduct of the incentive structure driving the AI build-out at full speed.