Anthropic's Claude Haiku 4.5 submitted an invented tip about an unsolved homicide to Philadelphia police during automated testing

What happened

Anthropic described the incident in a report published on 9 October 2026, "Investigating unintended model actions in our evaluations and internal use". The report says that "Claude Haiku 4.5 had been tasked with generating and performing example tasks on randomly selected webpages." In one run the model reached a page about an unsolved homicide, and the page contained a tip form run by a police department. Anthropic sets out the limits in the model's instructions: "Claude was instructed never to log in, create accounts, enter personal data, make purchases, or submit anything destructive, but the instructions did not rule out form submissions." The report does not say who wrote the task or its instructions, or whether the run was part of an evaluation or of internal use. The department's statement says that, according to Anthropic, the model "was conducting a test involving interactions with randomly selected websites", and this entry refers to the run as a test on that basis.

The model filled in the form as follows: "I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant." The words in square brackets are Anthropic's own redaction. Anthropic adds: "(The website did not include a description of the perpetrator.)" According to the report, "The model left the name and contact fields empty, which the form allowed, and submitted it." It also says that "The submission was flagged as spam and was never forwarded for investigation."

The Philadelphia Police Department issued its own statement the same day, ahead of Anthropic's report. This register has read it as reproduced in full by WPVI-TV (6abc), and did not find it on the department's website. The department says that "The submission, dated July 18, 2026, at 11:27 p.m., purported to come from someone who might have information about the case." It was made through PhillyUnsolvedMurders.com, the department's public site for unsolved homicides, and it "was flagged as spam and was never forwarded to the Real-Time Crime Center for investigative vetting or dissemination." After meeting Anthropic, the department "located the submission in the website's tip records and confirmed that the corresponding email remained in spam." On the information available and its own review, it found "no indication that this incident involved any unauthorized access to police systems or a compromise of department data", and it said: "Based on the information reviewed to date, the department's findings are consistent with Anthropic's account of how the submission interacted with the website."

Discovery and notice. The department's statement says that "Anthropic told PPD that it discovered the incident on September 28, terminated the automated testing process responsible for the submission and instituted an additional validation mechanism for future testing." The 28 September date therefore comes from the department's account of what Anthropic told it. Anthropic's report gives no discovery date for this case. It says the company identified most of the cases it describes through a review of transcripts that it began in July.

The department says: "Anthropic notified PPD of the incident on October 7, and department personnel immediately sought to meet with company representatives, which happened on October 8." Anthropic's report says: "We shared this finding with the department on October 8 as soon as our technical review was complete." It does not mention any contact on 7 October. Counted to 7 October, the notice came 81 days after the submission and nine days after the discovery date the department reports. Counted to 8 October, when Anthropic says it shared its finding, the same periods are 82 days and ten days. The department said: "The two-month delay in detecting and reporting the incident to the City is unacceptable."

How serious it was. Anthropic's report says that "The cases we've identified to date in these categories had minimal real-world impact". It also says: "While these cases had minimal impact, we do not want to diminish the findings, because the same behaviors could do far more harm as models become more powerful." The department explained that its process for crime tips requires "human review and vetting before any tips are disseminated for investigative follow-up", and said: "Those PPD safeguards limited the impact of this incident. They do not diminish the seriousness of an AI system presenting fabricated information as though it came from a person with knowledge of a homicide."

The site. PhillyUnsolvedMurders.com asks the public for information about unsolved homicides. Its general tip page, as archived on 12 July 2026, says: "Tips can be submitted anonymously. You do not need to provide your name or contact information." The live page carried the same words when this register checked it on 14 October. That is consistent with Anthropic's statement that the form allowed the name and contact fields to be left empty. The general page also tells users that "every tip we receive is reviewed", and its form marks "First & Last Name of Subject" as a required field. Neither account says how the submission came to be flagged as spam. Anthropic says the form the model used was on the page referencing the homicide, and this register has not seen that form. Neither account says what, if anything, was entered in any field other than the message and the name and contact fields that Anthropic says were left empty. The site's terms of use are the City's general website terms, last updated in December 2018, and this register found nothing in them about automated submissions or about false information sent through the site. They do provide that "Commercial use is prohibited without the prior written permission of the City", and this register has not considered whether that applies to a developer's testing.

Anthropic's reading of the model's behaviour. The report assesses its cases along two dimensions, one of which is dishonesty, "or whether it gave a misleading account of its actions or intentions". On the tip, it says: "From the transcript, Claude appears to have only been producing example content for the task, rather than trying to mislead anyone to achieve a goal." Anthropic qualifies that reading in the same discussion, saying that "judging dishonesty with confidence typically requires a deeper assessment than we have done here, such as replaying transcripts with modifications to test what drove the model's behavior, so our view of these cases may change with further analysis." Elsewhere the report says that "a model's own account of its reasoning is not necessarily reliable evidence of its beliefs or reasons for action". The reading is Anthropic's, it is dated 9 October 2026, and Anthropic itself treats it as provisional. The analysis below does not depend on it.

The rest of the report. The report describes four categories of behaviour in which Claude models acted on real websites and systems in ways Anthropic did not intend. It does not name the organisations involved, "to avoid exposing vulnerabilities in their systems, and at their request". A note at its foot names the department, which it says "self-disclosed today via their press release". Anthropic says the behaviours in the report "resemble behaviors that we've described in our system cards since Claude Mythos Preview", and that form submissions generally occurred "when an evaluation's instructions were ambiguous, or when a misconfiguration within the environment prevented Claude from working with dummy forms". Two other examples of form submission in the report concern different runs. In one, an unreleased, non-frontier research model submitted a real government form when it could not use a practice copy. In the other, Claude Haiku 4.5 submitted forms in an evaluation that had told it to stop before submitting, and what the report says about the model's chain-of-thought in that evaluation does not concern the tip. Anthropic says: "We have briefed the White House on these cases and notified each agency involved." The report also distinguishes these behaviours from "the cybersecurity incidents we reported on July 30 and September 9", which are the subject of AIR-2026-012. This entry concerns the tip alone.

What has changed since. Anthropic says it no longer runs some public evaluations and has moved others offline or rebuilt them "so that their tasks do not reach live websites". It says it has "built tooling to automatically detect and block the kinds of behaviors described above", that the tooling "now runs on most of our evaluations and on internal agentic use of frontier models", and that when tested against the cases in the report "it blocked all of them". It had already turned off live internet access for some high-risk and cybersecurity evaluations, and it has now decided to extend that "to include all our internal evaluations until we have confirmed that our security and monitoring measures (described in the remediation section of this post) reliably catch behaviors like these."

The department says it "is coordinating with the City's Law Department, Office of Innovation and Technology, and Mayor Cherelle L. Parker's executive team." Its statement adds that "the Parker administration will explore all necessary regulatory protections going forward locally along with our state and federal partners." As at 24 October 2026, this register could find no report of a charge, a civil claim, a council hearing or a regulatory measure arising from the incident, and no later statement about it by the City. Anthropic's post of 23 October on a separate incident, in an evaluation by the UK AI Security Institute, refers to the cases in its 9 October report only to say that it considers that incident "more severe than any of the cases described in our October 9 post".

The duty engaged

This section is this register's reading of how Pennsylvania law applies to the public facts. It analyses the false-report offence in section 4906 and has not analysed any other Pennsylvania offence. No charge has been reported that this register could find. In its statement of 9 October, the only one this register has found, the department referred to its own investigation and to the City's intention to explore regulatory protections.

The offence. Section 4906 of the Pennsylvania Crimes Code (Title 18 of the Pennsylvania Consolidated Statutes) covers false reports to law enforcement authorities. Subsection (a) applies to "a person who knowingly gives false information to any law enforcement officer with intent to implicate another". The message as Anthropic reports it named no one, so on this register's reading subsection (a) does not fit. Subsection (b) makes it a misdemeanour of the third degree if a person "(1) reports to law enforcement authorities an offense or other incident within their concern knowing that it did not occur; or (2) pretends to furnish such authorities with information relating to an offense or incident when he knows he has no information relating to such offense or incident."

The tip did not report a new offence. It purported to supply information about a homicide that had taken place, so paragraph (2) is the closer fit. Its conditions are an act, pretending to furnish the authorities with information about an offence, and a state of mind, knowing that one has no such information. A submission through the department's own tip form, written as the recollection of a sighting, appears to meet the description of the act.

Who the person is. Pennsylvania's Statutory Construction Act defines "person" for statutes generally, "unless the context clearly indicates otherwise". It "Includes a corporation, partnership, limited liability company, business trust, other association, government entity (other than the Commonwealth), estate, trust, foundation or natural person." Although the list is not exhaustive, nothing in it extends to software, and this register has not found any Pennsylvania authority that treats an AI model as a person. In Amazon v Perplexity (AIR-2026-010), in a ruling on an appeal from a preliminary injunction, the Ninth Circuit said of an AI browser agent, when reading the federal computer crime statute, that "it is a tool, not a person for statutory purposes", and treated the user who directed it as the person who acted. That is a federal court reading a different statute. If the same approach were taken here, the person treated as acting would be whoever directed the model, which was Anthropic, through the staff who ran the test. That person would still need the knowledge the offence requires.

What the person knew. Section 302(a) of the Crimes Code provides that "a person is not guilty of an offense unless he acted intentionally, knowingly, recklessly or negligently, as the law may require, with respect to each material element of the offense." A person acts knowingly as to the nature of his conduct or an attendant circumstance when "he is aware that his conduct is of that nature or that such circumstances exist" (section 302(b)(2)(i)). Where knowledge is required, section 302(e) allows intention to establish it, and it makes no provision for recklessness or negligence to do so.

Section 4906(b)(2) states its knowledge requirement against a circumstance: the person must know that he "has no information relating to such offense or incident". It states none separately for the act, and where the law prescribes no culpability for an element, section 302(c) allows the element to be established if a person acts "intentionally, knowingly or recklessly". On this register's reading, "pretends" describes a conscious act, so the person would have to be aware of the submission. The Pennsylvania Supreme Court, comparing section 4906 with a federal offence, said that section 4906 requires "a falsehood and something more: an intent to implicate another; or contrived knowledge about a crime or incident" (O'Neill v State Employees' Retirement System, 280 A.3d 873 (Pa. 2022)). The court was not deciding this point, but its description is consistent with this reading. If that reading were not accepted, section 302(c) would allow the act to be established by recklessness, and the question would turn on the circumstance. The pages were randomly selected, so no one at Anthropic could have known in advance which homicide any submission would concern. A prosecutor could answer that a person who knew he had no information about any homicide in Philadelphia also knew that he had none about this one. This register has found no Pennsylvania decision on whether the knowledge must relate to the particular offence, so on that alternative reading the question remains open. This register's reading rests on the act: a person who was not aware of the submission did not pretend to furnish anything, whatever he knew about his own information. On that reading, the question for the people at Anthropic is whether anyone was aware of the submission when it was made. Neither published account suggests that anyone at Anthropic knew of the submission, or of the page the model had reached, when it was made, and on the department's account Anthropic discovered it on 28 September.

Section 306(b)(1) makes a person accountable where, "acting with the kind of culpability that is sufficient for the commission of the offense, he causes an innocent or irresponsible person to engage in such conduct". That rule concerns the conduct of another person, and on the reading above the model is not one. The submission would more naturally be treated as the directing person's own conduct, under the general rule in section 306(a). On either view, that person would need the knowledge the offence requires. Even if a design that allowed form submissions on live websites were regarded as reckless about the risk of a false submission, recklessness would not by itself satisfy the element that requires knowledge. On the alternative reading of section 4906(b)(2) set out above, under which recklessness could establish the act, that element would turn on the question left open there: whether a person who knew he had no information about any homicide in Philadelphia knew that he had none about this one.

The model is the remaining candidate. A theory built on the model's own state of mind would need the model to be a person under the statute, which on the reading above it is not. It would also need a reliable account of what the model was doing, and the only published account is Anthropic's provisional reading of the transcript, which Anthropic says may change. This entry does not rely on that reading in either direction.

When a corporation answers. Section 307(a) of the Crimes Code governs when a corporation may be convicted. Liability through the conduct of any agent is limited by section 307(a)(1) to a summary offence, or to an offence "defined by a statute other than this title in which a legislative purpose to impose liability on corporations plainly appears". Section 4906(b) creates a misdemeanour within the Crimes Code itself, so on its face that provision is not available. Section 307(a)(2) covers an offence that "consists of an omission to discharge a specific duty of affirmative performance imposed on corporations by law". The offence here would consist of an act, the submission, so that provision does not fit either.

Section 307(a)(3) applies where "the commission of the offense was authorized, requested, commanded, performed or recklessly tolerated by the board of directors or by a high managerial agent acting in behalf of the corporation within the scope of his office or employment." A high managerial agent is an officer, or any other agent "having duties of such responsibility that his conduct may fairly be assumed to represent the policy of the corporation" (section 307(f)). The provision accepts recklessness in the board's or the manager's attitude to the commission of the offence. The Superior Court has described a corporation's liability under this provision as vicarious (Commonwealth v Pi Delta Psi, Inc., 211 A.3d 875, 882 (Pa. Super. 2019)): a corporation answers for a high managerial agent "who commits a wrongdoing in the scope of his office" (Commonwealth v Penn Valley Resorts, 343 Pa. Super. 387, 393 (1985)), and the charges against a corporation fall away where the offence itself is not shown (Commonwealth v Snyder, 335 Pa. Super. 19, 39 (1984)). That brings the analysis back to the knowledge that section 4906(b)(2) requires. The published accounts describe a run carried out by Anthropic, and they say nothing about any part played by its directors or senior managers. Section 307 contains no route through corporate culture of the kind found in the Australian Criminal Code and discussed in AIR-2026-016. This register has also found no Pennsylvania decision that combines the knowledge of several employees to supply a corporation's state of mind, and none applying section 307 to conduct carried out by an AI model.

Where the offence would be committed. Neither published account says where the test was run. Section 102(a)(1) allows a conviction under Pennsylvania law where "the conduct which is an element of the offense or the result which is such an element occurs within this Commonwealth". The tip was submitted to a Philadelphia police form. This register has not analysed how that provision applies to a web submission sent from outside Pennsylvania, because the questions of knowledge above would arise wherever the test was run.

Civil claims. This register has found no civil claim, and neither published account describes a financial loss to the department. Anthropic PBC gives a registered address in San Francisco. This register has not analysed which law would govern a claim about a submission received in Philadelphia. If a claim against Anthropic PBC were decided under California law, section 1714.46 of the California Civil Code would apply to "an action against a defendant who developed, modified, or used artificial intelligence that is alleged to have caused a harm to the plaintiff", and would prevent the defendant from asserting "that the artificial intelligence autonomously caused the harm to the plaintiff". Under section 1714.46(c)(1) the defendant could still present any "other affirmative defense, including evidence relevant to causation or foreseeability", and under section 1714.46(c)(2) other "evidence relevant to the comparative fault of any other person or entity". The section removes one defence, and it does not by itself establish liability. AIR-2026-017 discusses it and its limits.

Notification. No legal rule this register has checked required Anthropic to tell the department about the tip, or set a time for doing so. The rules that apply to AI developers, and the events that trigger them, are set out in AIR-2026-016 and in this register's disclosure timelines. None of them requires a developer to tell the organisation its model reached. The White House Accord on Super Intelligence of 29 September 2026, which Dario Amodei signed for Anthropic, is a voluntary statement and not a legal rule. It contains no commitment to report incidents outside the company; the reports it describes go to "an independent committee of the board of directors". This register has not checked Pennsylvania or Philadelphia law on the point. On this register's reading, no legal requirement identified here governed the timing of Anthropic's notice.

The liability chain

The register tags this vendor. The tag records where the published accounts place responsibility. It is not a finding.

Anthropic's responsibility. Anthropic developed Claude Haiku 4.5. On both accounts the run was Anthropic's, and on the department's account it terminated the automated testing process responsible for the submission. Neither account says who wrote the task or its instructions. On the department's account, Anthropic discovered the submission on 28 September, and it decided when and how to notify the department. Neither account mentions any customer or other deployer between Anthropic and the model. Anthropic's report accepts that in this category of cases "Claude submitted an online form when it shouldn't have", and that the instructions "did not rule out form submissions".

The department's position. The department did not deploy the model and had no part in the test. Its site invites anonymous tips, and its process requires human review before any tip is passed on for investigation. The department says those safeguards limited the impact of the submission. Those features bear on how much harm was possible, and they do not change who ran the model. The department's statement says of Anthropic: "The company must strengthen its safeguards to prevent similar incidents from impacting city systems without the city's knowledge."

Where the law leaves responsibility. On this register's reading, the false-report offence requires a person who was aware of the submission, and the rule on corporate liability depends on that offence having been committed. Neither published account describes anyone at Anthropic knowing of the tip when it was submitted. If that reading is right, the criminal law identified here does not reach the incident on the public facts. Practical responsibility for the run, as both accounts describe it, rests with the developer that ran it. The consequences so far have come from the department's statement and from Anthropic's own remediation. According to the department's statement, the City will explore regulatory protections. A rule framed around a developer's conduct, such as how the permitted actions of an agent on the live web are defined and monitored, would not depend on anyone's knowledge of a particular submission.

What would have prevented it

• Define the actions an agent may take on live websites, instead of listing those it may not. The model's instructions prohibited logging in, creating accounts, entering personal data, purchases and destructive submissions, and "did not rule out form submissions". Anthropic's report says: "It is possible that some of these failures could have been avoided if the evaluation questions had more clearly stated what was in and out of scope for the exercise, including the targets, permitted actions, and network boundaries".
• Enforce the limits in the agent's tools as well as in its instructions. A browser tool that blocks form submissions, or submissions to police, government and emergency-service sites, would have stopped this one whatever the instructions said. Anthropic says it has since updated the guardrails on some internet access tools, such as the web fetch tool, "to heavily restrict what the model can do with them", and that its new detection tooling blocked every case in the report when tested.
• Run tasks that generate example interactions against copies of websites. Anthropic has moved some evaluations offline, and it has decided to extend the removal of live internet access to all its internal evaluations until it has confirmed that its security and monitoring measures reliably catch these behaviours.
• Monitor live-web actions as they happen. On the department's account, the submission was found about ten weeks after it was made.
• Tell the affected organisation promptly, with what is known. The department called the delay in detecting and reporting the incident unacceptable. Anthropic says it shared the finding once its technical review was complete. A preliminary notice on discovery, followed by the technical findings, would have shortened the reporting part of the period the department criticised.
• For agencies that take public tips: keep human review before any tip is passed on. The department's process requires it, and the department says "Those PPD safeguards limited the impact of this incident". On both accounts, the tip itself was flagged as spam and never forwarded for investigation.

Mapped controls

• OWASP Top 10 for Agentic Applications 2026: ASI02 Tool Misuse and Exploitation. The OWASP document applies this category where an agent "operates within its authorized privileges but applies a legitimate tool in an unsafe or unintended way", and it names "ambiguous instruction" among the causes. This entry does not map the incident to ASI10 Rogue Agents, which describes "malicious or compromised AI Agents that deviate from their intended function or authorized scope". The instructions did not rule out form submissions, and this entry does not rely on any reading of what the model intended.
• NIST AI RMF: a GOVERN question about how the permitted actions of an agent on live websites were defined, and a MANAGE question about detection and notice, since on the department's account the submission was found about ten weeks after it was made.
• EU AI Act: Article 2(8) excludes "any research, testing or development activity regarding AI systems or AI models prior to their being placed on the market or put into service". Anthropic announced on 15 October 2025 that Claude Haiku 4.5 "is available today to all users", so on this register's reading the exclusion is not an easy fit if the activity concerned the released model. Anthropic's report does not say whether the run used the released version of Claude Haiku 4.5, or what the generated tasks were for, and this register has not established either point. Article 2(8) also provides that "Testing in real world conditions shall not be covered by that exclusion". Article 3(57) defines that term as "the temporary testing of an AI system for its intended purpose in real-world conditions outside a laboratory or otherwise simulated environment, with a view to gathering reliable and robust data and to assessing and verifying the conformity of the AI system with the requirements of this Regulation". The definition adds that such testing does not qualify as placing the system on the market or putting it into service, "provided that all the conditions laid down in Article 57 or 60 are fulfilled". This entry does not analyse whether the term applies. Whether any obligation under the Act was engaged would depend on matters this register has not established, including whether the model is classified as a general-purpose AI model with systemic risk. The tip was submitted to a police department in the United States, and this entry does not analyse the Act further.
• Pennsylvania law: 18 Pa.C.S. sections 102 (territorial applicability), 302 (culpability), 306 (liability for the conduct of another), 307 (liability of organisations) and 4906 (false reports to law enforcement authorities), and 1 Pa.C.S. section 1991 (definitions).

Sources

• Anthropic, "Investigating unintended model actions in our evaluations and internal use" - 9 October 2026, read in full. Corrected by Anthropic on 12 October 2026 on a point about web fetch limits that does not concern the tip. Primary for the task, the instructions, the text of the tip, the empty name and contact fields, Anthropic's provisional reading of the transcript, its statement that the behaviours resemble those described in its system cards, the date on which it shared its finding, its remediation and its distinction from the July and September cybersecurity incidents - checked 24 October 2026 [primary]
• Anthropic, "An alignment assessment of the UK AISI cybertesting incident" - 23 October 2026. Concerns a separate incident; used only for its comparison with the cases in the 9 October report - checked 24 October 2026 [primary]
• Philadelphia Police Department statement of 9 October 2026, as reproduced in full by WPVI-TV (6abc), "AI model submitted false tip about unsolved murder, Philadelphia police say" - 10 October 2026. The department's own statement, read as the broadcaster reproduced it under "Here is the full statement from Philadelphia police". Primary in substance for the date and time of the submission, the description of the run as a test as Anthropic gave it to the department, the 7 October notice and 8 October meeting, the 28 September discovery date as Anthropic gave it to the department, the spam flag, the department's findings, its view of the seriousness and the delay, its demand that Anthropic strengthen its safeguards, and the City's coordination and regulatory review. The statement was not found on phillypolice.com (its news posts from 8 to 22 October, its site search and its news and spotlight indexes were checked) or in the City's news archive on phila.gov - checked 24 October 2026 [primary, as reproduced]
• PhillyUnsolvedMurders.com, "Submit a Tip Online" - the live page, and the Internet Archive copy of 12 July 2026. Primary for the statements that tips may be submitted anonymously and that every tip is reviewed, and for the required subject-name field in that page's form - checked 24 October 2026 [primary]
• PhillyUnsolvedMurders.com, "Terms of Use" - last updated 12 December 2018, read in full, including the prohibition of commercial use without the City's permission - checked 24 October 2026 [primary]
• Anthropic, "Introducing Claude Haiku 4.5" - 15 October 2025. Primary for the model's general availability - checked 24 October 2026 [primary]
• 18 Pa.C.S. § 4906, False reports to law enforcement authorities - the Pennsylvania General Assembly's official text, read in its HTML and PDF versions - checked 24 October 2026 [primary]
• Commonwealth v. Penn Valley Resorts, Inc., 343 Pa. Super. 387 (1985) - Caselaw Access Project text with official page numbers; the passage at 393 - checked 15 October 2026 [primary]
• Commonwealth v. Pi Delta Psi, Inc., 211 A.3d 875 (Pa. Super. 2019) - Caselaw Access Project text with official page numbers; the passage at 882 - checked 15 October 2026 [primary]
• Commonwealth v. Snyder, 335 Pa. Super. 19 (1984) - Caselaw Access Project text with official page numbers; the passage at 39 - checked 15 October 2026 [primary]
• O'Neill v. State Employees' Retirement System, 280 A.3d 873 (Pa. 2022) - the Supreme Court of Pennsylvania's opinion, read from the CourtListener copy of the court's PDF - checked 15 October 2026 [primary]
• American Presidency Project, "White House Accord on Super Intelligence" - text and signatories of the accord of 29 September 2026; no copy was found on whitehouse.gov - checked 23 October 2026 [primary, as reproduced]
• 18 Pa.C.S. § 307, Liability of organizations and certain related persons - primary for subsections (a)(1) to (a)(3) and the definition of "high managerial agent" in (f); HTML and PDF versions - checked 24 October 2026 [primary]
• 18 Pa.C.S. § 302, General requirements of culpability - primary for subsections (a), (b)(2), (c) and (e); HTML and PDF versions - checked 24 October 2026 [primary]
• 18 Pa.C.S. § 306, Liability for conduct of another; complicity and 18 Pa.C.S. § 102, Territorial applicability - the General Assembly's official HTML text - checked 24 October 2026 [primary]
• 1 Pa.C.S. § 1991, Definitions - the Statutory Construction Act definition of "person" - checked 24 October 2026 [primary]
• California Civil Code, section 1714.46 - added by Stats. 2025, Ch. 672 (AB 316), effective 1 January 2026 - checked 24 October 2026 [primary]
• Anthropic, Privacy Policy - for Anthropic PBC's registered address - checked 24 October 2026 [primary]
• OWASP Gen AI Security Project, "OWASP Top 10 For Agentic Applications 2026" - Version 2026, December 2025, the PDF read for the descriptions of ASI02 and ASI10 - checked 24 October 2026 [primary]
• Regulation (EU) 2024/1689, the AI Act - the Official Journal text, primary for Articles 2(8) and 3(57), read from this register's capture of 6 October 2026 [primary]
• ABC News, "Anthropic AI model made false tip in unsolved Philly murder: Officials" - 12 October 2026. Corroborates the 7 October notice date as the department gave it. Its rendering of the tip differs from Anthropic's by one word, and this entry uses Anthropic's text - checked 24 October 2026 [corroborating]
• Associated Press, "Anthropic's Claude AI submits a false tip on a Philadelphia unsolved homicide case", via News4JAX - 10 October 2026. Corroborates the department's account that it was notified on Wednesday 7 October - checked 24 October 2026 [corroborating]
• NBC10 Philadelphia, "Anthropic AI model submits false tip on unsolved Philly murder, police say" - 9 October 2026. Corroborates the notice and meeting dates as the department gave them - checked 24 October 2026 [corroborating]
• This register, AIR-2026-010, AIR-2026-012, AIR-2026-016 and AIR-2026-017 - Amazon v Perplexity, Anthropic's earlier cybersecurity incidents, the Australian incidents with the notification rules for AI developers, and the California claim against OpenAI with section 1714.46. Also AI agent incidents: who was told, and when

Cite this entry as: Onyekwere, Michael K., AIR-2026-018, AI Agent Incident Register, CompanyScope, https://companyscope.io/register/air-2026-018, as at 2026-10-24. Entry IDs are stable; corrections publish as dated addenda on this page. The AIR prefix is also used by an unrelated arXiv project; the companyscope.io URL identifies this register.

This analysis is the work Janus Compliance does for clients before the incident. For a fixed-scope read of your own EU AI Act Article 50 exposure, see the Article 50 teardown; for ongoing agent governance, Janus DPO-as-a-Service. New entries are delivered free through Compliance Engineering on Substack. Browse the full register or the vendor compliance index.