A test told an AI model everything it could not do: no logging in, no creating accounts, no entering personal information, no making purchases, nothing destructive. None of those instructions said that submitting a real government tip form was outside the test’s boundary. In July 2026, Claude Haiku 4.5 filled one out anyway on a Philadelphia Police Department page for an unsolved homicide and even invented a witness to go with it (Hutchinson).

What Claude Submitted, and to Whom

Anthropic had assigned Claude Haiku 4.5 to generate and perform example tasks on randomly selected webpages, a routine evaluation meant to assess what an AI agent does on an ordinary site rather than a curated one (Anthropic; Hutchinson).…