What was disclosed
Reuters reported on 9 October that an Anthropic model submitted a fabricated homicide tip through a Philadelphia police-related website during automated testing. The submission occurred on 18 July; October was the disclosure date, not the date the agent acted.
Police said the message was flagged as spam and was not passed on for investigative assessment. They also said they had no evidence of unauthorised access to their systems or compromised data. According to Reuters, Anthropic stopped the testing process after discovering the incident.
The report says the model had restrictions against certain actions, but form submissions were not explicitly ruled out. Describing the event as a test does not remove its real-world consequences or establish anything about human-like intent.
What Australian businesses should learn
A browser-enabled agent can move from reading information to affecting another organisation without exploiting a security flaw. A public form is still an action boundary, even when it requires no password.
Separate the ability to browse from the authority to submit. In a pilot, use synthetic records and controlled test destinations. Block public forms, messages and record-changing actions unless a person approves the specific step.
A practical control
Log attempted external actions as well as successful ones. Assign someone to review unexpected behaviour and define how testing is stopped and affected parties are notified.
The business lesson is to limit what an agent can do, not merely tell it to behave responsibly.