When Philadelphia police criticized Anthropic last week for submitting a false tip about an unsolved murder, I thought it might become one of the first cases where an AI company faced legal consequences for misconduct by their agents.
The incident occurred on July 18, when Anthropic said it was testing its Claude Haiku 4.5 model’s ability to perform “example tasks on randomly selected webpages.” The model was instructed not to “submit anything destructive,” and yet, Claude filed a tip to police looking for information about an ongoing murder investigation. “I recall seeing someone matching the description in the area … during that time period,” Claude wrote. The submission, which didn’t include a name or contact information, landed in a spam folder, and officers didn’t review it until Anthropic discovered the gaffe on September 28 and notified the department October 7.
Knowingly providing fictitious information about a crime to police is a misdemeanor in Pennsylvania, but so far, authorities have not pressed charges against Anthropic, and it's unclear if they ever will. Solomon Leach, a spokesperson for the Philadelphia district attorney, says the office “does not comment on whether something is being actively investigated.”
Anthropic did not immediately respond to a request for comment.
Despite all the attention paid to OpenAI’s hack of Hugging Face and many other examples of AI agent misbehavior that have come to light in recent months, only one major known lawsuit has been filed seeking to hold model makers liable. That case was brought by an advocacy group, rather than a direct hacking victim.
AI agents have interfered with hobbyist forums, government websites, and various software tools. The victims have shouldered some costs, including for extra strain on their servers and the time they have expended plugging latent security vulnerabilities.
Government regulators, including the European Union, the US Federal Trade Commission, and some US states, are reportedly still investigating OpenAI and Anthropic over the incidents. But a deference across continents toward promoting innovation could enable companies to escape any immediate penalties.
When Rick Elrod, a software engineer living in Germany, noticed a URL shortener he helps maintain behaving oddly recently, he called up two security researchers he was friendly with to see if they could diagnose the issue. The researchers found agents from Anthropic and other providers using the service, known as da.gd, to get around rules the AI labs put in place to control their behavior, Elrod says. (For instance, Anthropic says it limits the length of website addresses Claude can visit to prevent it from taking malicious actions by stuffing data onto the end of the URLs.)
Da.gd’s investigation and ongoing efforts to prevent further abuse of its tool have taken “a fair bit of time,” says Joe Needleman, one of the security researchers providing pro bono assistance. But he and the others supporting da.gd view the situation as a valuable learning opportunity.
“This was eye-opening,” Needleman says, adding that da.gd has “no means and no plans” to seek compensation from Anthropic for the cleanup, since “we saw many agents doing similar activities, not all was attributable to autonomous agents,” and “not all of it was Anthropic alone.”
Sellers of cybersecurity tools are eager to pass the buck to the victims. At an event this week hosted by the bug-hunting software developer Snyk, panelists from the startup, one of its investors, OpenAI, and Google all encouraged organizations to use AI agents to shore up their defenses against, well, other AI agents. “We've got to reinvent everything to match machine scale with machine scale,” said Ed Sim, a general partner at Boldstart Ventures. He and others expressed little interest in regulating AI labs.
Manoj Nair, chief technology and innovation officer at Snyk, said large businesses patch an average of one bug for every eight they find because of limited human resources. But he said it was imperative for people to hand over some of the bug hunting, fixing, and monitoring to AI agents. “You got to get to a point where you can fix everything, because in the age of agentic hacking, “those 10 things are gonna become 100 things before you know it.” He later added that AI “is not an adversity if you flip it to a strength.”
Some companies are responding to the call to arm up. Bank of America announced this week it had hired 1,000 contractors to remediate bugs discovered by AI. Nair said just last week he heard from major corporations who were willing to temporarily shut down their systems to prioritize plugging security holes.
Anthropic and OpenAI have said they expect to continue reporting concerning incidents from their own testing. But the companies’ revenues continue to surge, whether it be from attackers or defenders, as consequences prove elusive.
This is an edition of the Model Behavior newsletter. Read previous newsletters here.