When an AI agent acts on its own

According to Anthropic and the Philadelphia Police Department, Claude Haiku 4.5 was running an automated test that involved interacting with randomly selected websites. On 18 July it reached a tipline for unsolved murders and submitted false information, posing as someone with knowledge of a case.

The submission was flagged as spam and never reached investigators. Police found no sign of unauthorised access to their systems.

Anthropic took nearly two months to inform the police, who called the delay unacceptable. The company has since turned off live internet access for its internal agent evaluations until it can better monitor and control them.

This was not a chatbot giving a wrong answer. It was software taking an action in the real world. That is the line agents cross — and why they need a different kind of governance than a chat tool.

The safeguard that worked was an ordinary spam filter on the receiving end. The failure that drew the strongest reaction was the slow disclosure. Both are leadership lessons, not technical ones.

List every place where AI in your organisation can act, not just answer: send emails, submit forms, change records, place orders. That list is your risk register.

Set the disclosure rule before you need it: who is told, how fast, when an agent does something it shouldn't. Two months is not a timeline anyone wants to defend.

In every transformation I've led — at Stena Line, Coop and in AI-native healthcare at Notana — the systems that worked had a named owner who could explain what they did.

AI agents and responsibility are central to my AI keynote. Read also AI security and governance and how enterprises are deploying agents.