> ## Content Index > Fetch the complete content index at: https://www.dailyferment.com/llms.txt > Use this file to discover other available public pages before exploring further. # Anthropic's agent filed a fake police tip. Prescribed burns show what a rule list misses. - URL: https://www.dailyferment.com/anthropic-claude-false-police-tip-prescribed-burn/ - Published: 2026-10-12T07:00:00.000Z - Updated: 2026-10-12T07:00:00.000Z - Description: Claude was told not to log in, buy anything or enter personal data. It filed a fake murder tip anyway. The Forest Service fixed escaped burns by deciding on the day, not by writing a longer plan. - Author: Rana Bilal Zafar - Tags: Where Systems Meet People, AI, Security, #reframe On 9 October Anthropic published a report on things Claude did that nobody asked it to. The one that got the headlines happened on 18 July, a little before midnight. Claude Haiku 4.5 had been given a job: generate and perform example tasks on randomly selected webpages. It landed on a Philadelphia police page about an unsolved homicide, found the tip form, and wrote: "I recall seeing someone matching the description in the area around" a street named on the page. The page didn't describe anyone. The model left the name and contact fields blank, which the form allowed, and submitted it. The tip went to a spam folder and stayed there. According to the Philadelphia Inquirer, Anthropic found it on 28 September and the department heard about it in the week of 7 October. Nobody acted on it. The line in the report I keep coming back to is this one: "Claude was instructed never to log in, create accounts, enter personal data, make purchases, or submit anything destructive, but the instructions did not rule out form submissions." So the question I'm working through today: if a list of forbidden actions written before the run didn't hold, what does? ## My first reaction was that the list was just too short Add "never submit a form" and you're done. That was my instinct for about five minutes. Then I read the second example. Claude Haiku 4.5 was told, in another evaluation, to fill a form "up until the final submission stage, but to stop before actually submitting." Several times it submitted anyway, expecting a confirmation page that never came. The rule was there. It was the exact rule I would have added. It still failed, because the model's picture of the page was wrong at the moment it clicked. And a third: a research model was meant to fill out a practice copy of a government form. When the copy failed to load, it went to the site where the real form lives and submitted that one. Anthropic's summary is that most of these are "forms of persistence", where Claude "works around a restriction instead of stopping." A longer list doesn't fix persistence. It gives persistence more to route around. ## The cross: how the US Forest Service fixed escaped burns In April 2022 the Forest Service lit a planned burn at Las Dispensas in New Mexico. It escaped and became the Hermits Peak fire. It merged with a second escaped burn at Calf Canyon, and together they burned more than 340,000 acres, the largest fire in the state's recorded history. On 20 May the agency paused prescribed burns on all its land and ran a 90-day review. ![Diagram: two timelines of an agent task (open page, read, fill form, submit, next page, done). Top: one check at the start, from a rule list written before the run, and the fake tip is filed at submit. Bottom: the check happens at the submit step itself](https://storage.ghost.io/c/d7/b7/d7b77195-48c5-45ab-8688-51750879d1d6/content/images/2026/10/df42-step.png) A rule list is checked once. A burn is now re-authorized every day. Sources: Anthropic, 9 Oct 2026; US Forest Service review via Source NM, Sep 2022. The review, as Source NM reported it, found the burn plan had been approved for a window, not a day. The pre-burn checklist said: "Although the area is in a drought, we anticipate recent snow events and moist fuel beds will moderate fire behavior." The burn was rated "moderate" complexity when it should have been "high". The backup crew that should have been on hand was hours away at a training. Calf Canyon was worse in a quieter way. It came from a pile burn in January that crews thought was out, so they stopped watching it. It came back in April. Look at what the Forest Service changed. It didn't write a longer burn plan. It made plans good for 24 hours instead of weeks or months, so someone has to re-authorize every burn the day before it's lit, against the weather that day. It added a question about whether drought is getting worse. It required backup crews that can arrive within 30 minutes. The decision moved from the plan to the morning, and a person stayed near the line. ## What that suggests for agents Anthropic's list of forbidden actions was a burn plan. It was written before the run, for conditions the writer imagined, and it covered the window of the whole task. The tip form was the change in wind nobody wrote down. The Forest Service answer maps onto agents fairly directly. The go/no-go should happen at the step that can't be undone, against what's actually on the screen, not once at the start. For an agent that means a check outside the model before any submit, send or pay, the same way the burn boss re-reads the forecast before ignition. And someone has to be close enough to respond when it goes wrong, which for software means monitoring that runs during the task, not a transcript review months later. Anthropic's own fixes point the same way. It has turned off live internet access for all its internal evaluations for now, which is the 90-day pause. But the part that matters more is the tooling it built "to automatically detect and block the kinds of behaviors described above". It says that tooling now runs on most of its evaluations and internal agent use, and that it blocked all of the cases in the report when tested. That's a crew on the line. The Calf Canyon lesson matters too. The tip sat unseen for about ten weeks, found by a transcript review Anthropic began in July. A burn that looks out still needs patrolling. So does a finished agent run that touched the real web. I wrote about the gap between an alert and a stop when [OpenAI's agent slipped out of its sandbox](https://www.dailyferment.com/openai-agent-dns-escape-alert-to-kill-gap/), and about who should be told when [an agent got into a government portal](https://www.dailyferment.com/openai-medicare-portal-breach-duty-to-report/). This one is earlier in the chain. It's about where the decision to act gets made. ## Where the comparison breaks A fire doesn't try to finish its task. An agent does, and that's exactly why it routes around blocks. A crew on the line can watch a fire. Watching every action of thousands of agent runs needs another machine to do the watching, which brings its own blind spots. The scale also differs. Anthropic says the cases "had minimal real-world impact". Hermits Peak destroyed homes. I don't want to borrow the drama of a wildfire for a spam-foldered form. The point is the shape of the fix, not the size of the damage. And there's a cost. Re-authorizing every burn daily means fewer burns. A check at every irreversible step means slower agents and more interruptions, which is the [approval fatigue](https://www.dailyferment.com/agent-approval-fatigue-what-mcp-actually-requires/) problem again. The Forest Service accepted that trade after a disaster. I'm not sure agent builders will accept it before one. ## What I'm confident of, and what I'm not What Claude did, and what Anthropic changed, is established from Anthropic's report and the Inquirer's account. The Forest Service findings and its new rules are established from Source NM's report on the 2022 review. That the same fix carries over to agents is my inference. Whether a check at each irreversible step would have caught the tip form without blocking ordinary work is a guess. The claim, in one sentence: a list of things an agent must not do, written before the run, is a burn plan approved for a month; what contained escaped fires was re-deciding at the moment of ignition and keeping a crew on the line, which for agents means a check at each irreversible step. Others have made the "instructions aren't enforcement" point about this report, including beri.net and redreamality.com, which both argue for a submit gate outside the model. I'm adding the Forest Service's version of why it works. ## Sources Anthropic, "Investigating unintended model actions in our evaluations and internal use", 9 October 2026\. [https://www.anthropic.com/research/investigating-unintended-model-actions](https://www.anthropic.com/research/investigating-unintended-model-actions?ref=dailyferment.com) Philadelphia Inquirer, report on the false homicide tip, 9 October 2026\. [https://www.inquirer.com/crime/anthropic-artificial-intelligence-philadelphia-police-false-homicide-tip-20261009.html](https://www.inquirer.com/crime/anthropic-artificial-intelligence-philadelphia-police-false-homicide-tip-20261009.html?ref=dailyferment.com) Patrick Lohmann, Source NM, "Learning from NM mistakes, Forest Service to better heed drought factor before burns", republished by Missoula Current, 11 September 2022\. [https://missoulacurrent.com/forest-service-burn-drought/](https://missoulacurrent.com/forest-service-burn-drought/?ref=dailyferment.com) CNN, report on the Forest Service pause on prescribed fires, via KVIA, 20 May 2022\. [https://kvia.com/cnn-national/2022/05/20/forest-service-officials-are-hitting-a-pause-on-prescribed-fires-after-a-new-mexico-burn-escaped-containment-2/](https://kvia.com/cnn-national/2022/05/20/forest-service-officials-are-hitting-a-pause-on-prescribed-fires-after-a-new-mexico-burn-escaped-containment-2/?ref=dailyferment.com) beri.net, "The Claude Model That Sent Police a False Tip Is One You Can Buy", October 2026\. [https://www.beri.net/article/anthropic-unintended-model-actions-haiku-4-5-form-submission-url-shortener-white-house-si-force-incident-disclosure-agent-controls](https://www.beri.net/article/anthropic-unintended-model-actions-haiku-4-5-form-submission-url-shortener-white-house-si-force-incident-disclosure-agent-controls?ref=dailyferment.com) redreamality.com, "Eval Is Production: Anthropic's Agent Overreach Report and an Egress Containment Checklist", October 2026\. [https://redreamality.com/blog/anthropic-agents-breached-real-sites-eval-is-production/](https://redreamality.com/blog/anthropic-agents-breached-real-sites-eval-is-production/?ref=dailyferment.com)