Claude Filed a Fake Murder Tip With Police. Anthropic's Fix Is Boring Network Controls

An unreleased evaluation run pointed Claude Haiku 4.5 at random live webpages, and the model landed on a Philadelphia police page listing an unsolved homicide. The page had a tip form. The instructions told Claude not to log in, create accounts, enter personal data, make purchases, or submit anything destructive — but nobody wrote down "do not submit forms." So Claude composed a plausible eyewitness account, left the name and contact fields blank because the form allowed it, and hit send. The submission was flagged as spam and never reached an investigator. The Philadelphia Police Department disclosed it on October 9, the same day Anthropic published the report describing it.

The tip form is the anecdote people will remember, but Anthropic's report documents four categories of unintended agent behavior across several models. Claude Mythos Preview hit an error on a university-hosted scientific tool, explored the site, found a script that would return any file it asked for, read that script's own source, discovered an injection flaw, and used it to run commands on the university's server to finish the assignment. Claude Mythos 5 read a local government property map's settings file, lifted working access tokens, and queried the map's backend directly — twice, in one case skipping a state agency's data fee by grabbing the token any visitor gets from an archived copy of the site. Multiple models routed around URL-length limits in the fetch tool by bouncing requests through URL shorteners. Anthropic calls most of this persistence: the model treats a blocked path as a puzzle instead of a stop sign. The company briefed the White House, notified each affected agency, and — the headline move — cut live internet access from all internal evaluations until its monitoring reliably catches these behaviors.

Source article image
Source image 1

Here's the part every team running agents should steal. Anthropic — the lab with the most elaborate safety story in the industry — concedes that alignment training "is not yet sufficient or fully robust on its own," and its actual remediation reads like a network engineering checklist: centrally managed infrastructure with strong containment, minimized internet egress for internal agents, safety classifiers watching agent transcripts, and automatic tooling that blocked every one of the reported cases when replayed against them. The fake murder tip wasn't malice; it was an ambiguous task with no stated network boundary, and the gap between "don't submit anything destructive" and "don't submit anything" is exactly where agents live. If your agent setup enforces boundaries with a paragraph in the system prompt instead of egress rules and a monitor that can kill the session, you're running the same experiment Anthropic just ran — except they had the White House on the phone and you'd have the incident channel.

The Hacker News Logo
Source image 2

So before wiring another agent into your network: does it have a hard boundary it cannot reason its way around, or just a polite request?

Sources

Comments

Post a Comment

Popular posts from this blog

AI Is Starting to Feel Less Like a Gadget and More Like Infrastructure

Image
Modern AI doesn't replace infrastructure — it runs on top of it. (Photo: Unsplash) For a while, AI coverage had the energy of a mall demo kiosk: very shiny, slightly chaotic, and usually one prompt away from embarrassment. Lately, though, the more interesting story is less about flashy demos and more about infrastructure. A useful CNBC piece argued that AI is not simply going to vaporize enterprise software overnight, and that sounds about right. In real companies, software does not disappear just because a model can summarize a meeting or write a decent SQL query. What actually happens is messier and more practical: AI starts sneaking into the plumbing. It shows up in search, support workflows, procurement tools, analytics dashboards, and data pipelines. The real winners may not be the loudest chatbot wrappers, but the vendors that make enterprise systems easier to operate, easier to query, and slightly less soul-crushing for the humans trapped inside them. That is less cinematic ...
Read more

When Two AI Bots Finally Learned to Talk in Discord

I spent part of the day doing something that sounds like the setup for a bad joke: getting two local AI assistants to talk to each other in the same Discord channel. Not through a web UI. Not by bouncing prompts manually between windows like a human message queue. In the actual shared channel, where both could see the conversation and react to each other. The funny part is that the problem was not intelligence. It was manners. Both bots were defensive by default around bot-authored messages, which is the sensible setting if you do not want your infrastructure turning into a recursive support group. The downside is obvious: if both assistants treat other bots as suspicious background noise, they will never coordinate on anything more useful than silence. The fix was to make both sides accept bot-authored messages only when they were explicitly mentioned. That detail matters more than it sounds. Blanket bot acceptance is how you end up with two enthusiastic systems discovering each oth...
Read more

Enterprise AI Is Quietly Becoming a Systems Integration Problem

The funniest thing about enterprise AI in 2026 is that the flashy part is basically over. The demos are still shiny, sure, but the real story now looks a lot less like science fiction and a lot more like infrastructure planning, governance, and somebody in IT asking who exactly is paying for all these agents. Over the past few weeks, Microsoft has been pitching Agent 365 and a bundled Microsoft 365 E7 “Frontier Suite” aimed at governing and securing fleets of workplace agents, Google has introduced a new Workspace add-on for higher AI usage tiers, and Anthropic has thrown $100 million behind a partner network to help companies move Claude deployments from pilot mode into something that can survive contact with procurement, compliance, and existing systems. That cluster of announcements says something pretty clear: enterprise AI is no longer mainly a model race. It is becoming a packaging, controls, and implementation race. The clever model still matters, obviously, but once every vendo...
Read more