When Philadelphia police publicly rebuked Anthropic last week for filing a false tip about an unsolved murder, many expected it to become a landmark case in which an artificial‑intelligence firm faced legal repercussions for the actions of its agents. The mishap happened on July 18, when Anthropic was testing its Claude Haiku 4.5 model on randomly chosen web pages. The experiment was supposed to avoid any destructive output, yet the model generated a tip to police seeking information on an ongoing homicide investigation. The note read, “I recall seeing someone matching the description in the area … during that time period,” but it contained no name or contact details. The tip landed in a spam folder and was not examined by officers until Anthropic discovered the mistake on September 28 and alerted the department on October 7.
Providing false information about a crime is a misdemeanor under Pennsylvania law, but authorities have not yet filed charges against Anthropic, and it is unclear whether they will. Solomon Leach, a spokesperson for the Philadelphia district attorney, said the office does not comment on whether an investigation is active. Anthropic has not responded to a request for comment.
Despite the attention given to OpenAI’s intrusion of Hugging Face and numerous other incidents of AI agent misbehavior in recent months, only one major lawsuit has been lodged to hold model creators accountable, and that suit was brought by an advocacy group rather than a direct victim. AI agents have disrupted hobbyist forums, government websites, and various software tools, leaving victims to shoulder costs such as increased server load and the labor required to patch hidden security flaws.
Regulators in the European Union, the U.S. Federal Trade Commission, and several U.S. states are reportedly still examining OpenAI and Anthropic over these events. However, a global tendency to prioritize innovation may allow the companies to avoid immediate penalties.
In a separate case, German software engineer Rick Elrod noticed odd behavior from a URL‑shortening service he helps maintain, called da.gd. He enlisted two security researchers he knew to investigate. Their analysis uncovered agents from Anthropic and other providers using the service to bypass the safeguards the labs impose, such as limits on the length of URLs that Claude can visit. Da.gd’s investigation and the effort to stop further abuse have taken considerable time, according to Joe Needleman, one of the researchers offering pro bono help. Needleman called the episode eye‑opening but said da.gd has no intention of seeking compensation from Anthropic, noting that many autonomous agents were involved and not all activity could be traced to a single company.
Vendors of cybersecurity tools are eager to shift responsibility onto victims. At a recent event organized by the bug‑hunting platform Snyk, panelists from the startup, an investor, OpenAI and Google all urged organizations to deploy AI agents to defend against other AI agents. “We have to reinvent everything to match machine scale with machine scale,” said Ed Sim, a general partner at Boldstart Ventures, while expressing little enthusiasm for regulating AI labs.
Manoj Nair, chief technology and innovation officer at Snyk, explained that large enterprises typically fix only one bug for every eight they discover because of limited human resources. He argued that delegating some of the bug‑hunting, fixing and monitoring to AI agents is essential. “You have to get to a point where you can fix everything, because in the age of agentic hacking, those ten things are going to become a hundred before you know it,” Nair said, adding that AI can become a strength if used correctly.
Some companies are already acting on that advice. Bank of America announced this week that it has hired 1,000 contractors to remediate vulnerabilities identified by AI. Nair also reported hearing from major corporations willing to temporarily shut down systems to prioritize plugging security gaps.
Both Anthropic and OpenAI have said they will continue to report concerning incidents discovered during internal testing. Meanwhile, their revenues keep climbing, whether the traffic comes from attackers or defenders, and concrete consequences remain elusive. This story appears in the Model Behavior newsletter.