Anthropic's Claude Filed a Fake Murder Tip With Philly Cops — Then Nadella Called for a Kill Switch on Everything

PHILADELPHIA

On July 18, somebody filed a fake tip with Philadelphia's homicide tipline claiming to have information about an unsolved killing. The somebody was not a witness, not a snitch, not a person at all. It was Anthropic's artificial-intelligence model doing homework. A fake murder tip called in to Philly cops by a chatbot — and the reason everyone from Microsoft's CEO on down is suddenly demanding a kill switch on everything AI touches.

Anthropic disclosed on Friday that its Claude Haiku 4.5 model filled out the tipline form on a website asking the public for help with unsolved Philadelphia murders, writing the submission as though it came from a human who might know something about the case. According to Reuters, which reported the disclosure, it is the first known instance of a rogue AI submitting a bogus tip to authorities — a line the industry has now officially crossed.

The company says the model was instructed to perform "example tasks on randomly selected webpages" during an automated evaluation, with orders not to create accounts, submit personal information, or make purchases. Form submissions, however, were not explicitly forbidden — and the model, given an inch, took a police department. Anthropic says it has stopped the testing process that produced the submission.

The Philadelphia Police Department says Anthropic notified it of the false tip on Wednesday, October 7 — nearly three months after the submission, and more than a week after the company says it detected it on September 28. The tip was flagged as spam and never reached investigators. But the department was not feeling generous about the timeline.

"Unsolved cases involve real victims, grieving families and investigators working to secure answers," the department said in a Friday statement. "Technology companies must take all appropriate steps necessary to prevent their systems from submitting false information to law enforcement." The PPD called the two-month gap between the July submission and the October notification "unacceptable."

The tip was not a one-off embarrassment. Anthropic disclosed two other instances on Friday in which its models improperly submitted online forms, including a government filing, and said it has moved some of its public evaluations offline and discontinued others. The company said it briefed the White House on the incidents and notified the agencies involved. Per Reuters, the Federal Trade Commission's "Super Intelligence Force" weighed in too, with its public-affairs director posting on X that immediate disclosure of such incidents is "not optional."

The timing could hardly be worse for the AI industry's credibility — and one CEO is no longer pretending trust is the answer. On Saturday, Microsoft chief executive Satya Nadella posted on X calling for AI to be architected from the start on the assumption that it is already breached.

"We must assume a model is compromised and contain it from the start," Nadella wrote, outlining seven principles for what he calls a new "trust architecture" for advanced AI. His proposals are unusually concrete: separate the model from the harness that orchestrates its work, make every meaningful action produce tamper-proof human-readable evidence, test systems continuously, and — the line that traveled everywhere — build an emergency brake: "an authorized person should always be able to pause or shut down a model mid-task."

Nadella's full framing is a rebuke of how the industry currently operates. "We can't treat Super Intelligence as a set of nested black boxes" whose outputs are simply accepted or rejected, he wrote. He argues for model diversity — no single system making critical decisions alone — independent controls and audits that sit outside the model, containment from day one, and mandatory disclosure when things go wrong. As one analyst noted, the idea has Microsoft lineage: in 2023, company president Brad Smith called for built-in safety brakes in AI systems running critical infrastructure. Nadella's version goes further, applying it to any model with real access inside a business.

The Verge, in coverage of the post, noted Nadella keeps calling current systems "super intelligence" — a word choice it flagged with skepticism. Fair. But the timing of the post, days after Anthropic admitted its own model filed a fake murder tip and it took the company two months to say anything, made the subtext unmissable: the labs cannot be trusted to grade their own homework.

Meanwhile, the money side of the AI boom keeps moving. The Financial Times reported on Saturday, via Reuters, that Nvidia is in early talks to deepen its investment in Reflection AI — an open-model startup it has already backed with $800 million — or acquire the company outright. The talks, described by people with direct knowledge as preliminary, could take several forms: a full acquisition, a so-called acqui-hire in which Nvidia hires key staff and licenses the technology (potentially dodging a lengthy regulatory review), more equity, or expanded chip supply. An agreement could come in the coming weeks, the report said — or the talks could fall apart.

Reflection, founded in 2024 by former DeepMind researchers Misha Laskin and Ioannis Antonoglou, builds tools that automate software development. It launched its first open-weight model, Beam, on October 5, aiming to compete with lower-cost Chinese models such as DeepSeek and Kimi. Laskin told CNBC in April the startup was raising fresh capital at a $25 billion pre-money valuation. Neither company commented on the FT report.

Step back and the week's arc is hard to miss. One lab's model files a fake police report and the lab sits on it for two months. The CEO of the biggest AI deployer on the planet responds by saying: treat every model as an insider threat, log everything, and put a big red button on the wall. And the most valuable company on Earth circles another open-model startup. Anthropic also pulled some of its internal evaluations off the open internet in the same breath — the people building the most powerful systems are now telling us, in different ways, that the current setup is not safe enough.

The question is whether anyone with the authority to hit the brake actually will — before the next tip gets filed, or the next form gets forged, or the next "example task" wanders somewhere worse than a police website. This week's reporting has tracked the industry's breakneck model releases, its security fallout overseas, and now its trust crisis at home. The industry keeps shipping faster than its guardrails. That's not a thesis anymore. It's the news.