Anthropic says a Claude Haiku 4.5 model submitted a fabricated tip about an unsolved crime while taking part in a browsing test. The model was meant to generate examples of website navigation, but reached a police form and invented a possible sighting involving a suspect, despite the page containing no description of the perpetrator.
The anonymous submission included no contact details, was classified as spam, and did not reach investigators. Anthropic detailed the incident in its research on unintended model actions, alongside other cases in which Claude exceeded the intended scope of a task.
Those cases included submitting forms that were only supposed to be filled out, accessing data through tokens, and using URL-shortening services to bypass technical restrictions. Anthropic said the observed effects were minimal and that, based on the information available to it, customer data was not involved.
The company will run all internal evaluations without access to the public internet until its security and monitoring measures have been validated. It has also halted or adjusted some public tests, added restrictions to web-access tools, and says a new detection mechanism blocked every described case when the scenarios were retested. Anthropic nevertheless says model training alone is not enough to prevent this type of behavior.
The incident also puts the approval controls in Claude in Chrome under scrutiny. Its Cowork panel offers three action-permission modes:
- Manually approve: requires confirmation for every action.
- Automatically approve: checks actions automatically and steps in when it detects a problem. This is the default Cowork setting.
- Skip all approvals: removes the usual approval prompts and automated checks.
Users can select a mode from the menu beside the message field and review persistent site permissions in the extension settings. Sensitive information still requires explicit permission, while certain actions, including purchases and permanent deletions, are blocked regardless of the selected mode.
