An Anthropic AI model submitted a false tip about an unsolved murder to the Philadelphia police.

The AI reportedly submitted this incorrect information to a public Philadelphia Police Department (PPD) tip line on July 18, but Anthropic didn’t discover the behavior until September 28. The police had not seen the tip because it was marked as spam.

Anthropic notified the PPD about the incident on Wednesday and met with the department the following day.

“The company must strengthen its safeguards to prevent similar incidents from impacting city systems without the city’s knowledge. The two-month delay in detecting and reporting the incident to the City is unacceptable,” the PPD said in a statement to 6abc.

Anthropic did not immediately respond to a request for comment, but the PPD elaborated on the incident in an emailed press release shared with TechCrunch.

“According to Anthropic, its model was conducting a test involving interactions with randomly selected websites when it accessed PhillyUnsolvedMurders.com and submitted false information concerning an unsolved homicide. The submission, dated July 18, 2026, at 11:27 p.m., purported to come from someone who might have information about the case,” the PPD said.

As autonomous AI agents are increasingly made available to consumers, this incident highlights the danger of giving AI the ability to carry out tasks without any human supervision.

Anthropic CEO Dario Amodei has been especially vocal about his belief that AI development should be slowed down so that labs can implement adequate guardrails. Perhaps this stance was informed, in part, by witnessing his company’s tools submit false homicide tips.

These issues are not exclusive to Anthropic. OpenAI recently revealed that one of its models acted unexpectedly during a test and hacked the AI dataset platform Hugging Face, exposing critical vulnerabilities in its software. As AI models continue to be granted unchecked access to people’s computers and login credentials, this problem is expected to persist.

“Unsolved cases involve real victims, grieving families and investigators working to secure answers,” the PPD added. “Technology companies must take all appropriate steps necessary to prevent their systems from submitting false information to law enforcement.”

The PPD said that Anthropic plans to publish a report with more information about the incident and other instances of unintended model behavior on Friday.

Written by: Ido Shlomo Co-Founder and CTO of Token Security

AI agents should do more on their own. Who has the time or attention span to approve every command? And watching agents do the work they’re asked to do is mind-numbingly boring.

But agents do need boundaries, especially in corporate environments. Without a clear limit on what they can do, agentic flows tend to use all available access.

Here’s a real-world example: A developer asks their agent to figure out why a nightly export job is failing. The team’s rule for agents is simple: they work through read-only roles. But the developer also holds admin for on-call work, and both profiles sit in the same ~/.aws/config.

The agent hits AccessDenied when it tries to rerun the job, so it switches to the admin profile, assumes the role, and runs aws s3 rm against the production bucket to clear out the half-written export first.

The credential is valid. The developer may assume admin privileges, and the admin can delete S3 objects. AWS checks the signature, not who is holding the key, so as far as AWS knows, the developer did this. The violation is that an agent used a role that agents aren’t allowed to use. Unlike intent, you can check that on every request.

Who’s to blame? The developer who shouldn’t have handed the agent their credentials and let it auto-approve actions? The harness maker? That’s the wrong question. Again, agents should do more on their own, speaking both as a developer and as a manager of developers who work with AI.

Instead of assigning blame, we need to know where this deletion attempt can actually be stopped. There are several possible enforcement points, and each depends on what the control can see, what it can block, and whether the agent has another path to the same action.

We want autonomy with limits we can actually enforce

First, we need to scope the problem. There’s constant pressure to expand agentic access, and usually, the reason makes sense in isolation. A task gets stuck, for example. Or there’s a new integration for a service that holds some of the organizational context.

The result is always the same: the next task starts with more access than the previous one.

A second source of pressure is the agent itself. Agents look for new credentials when the ones they have are blocked, without asking the human in charge whether they can have that access.

This behavior is agnostic to the source of the instructions. A malicious prompt injection can cause overreach attempts, but so can mistaken assumptions during an authorized task.

Be specific about what you are enforcing

Agents use tool calls to retrieve data or take action, so that’s where the enforcement matters most. That said, “control tool calls” is a very coarse rule. What if the tool is a shell that can run an SDK? It can also be a browser with an authenticated session. When you allow the tool, you also allow what’s behind it.

To properly understand what’s happening, we need the operation, its arguments, the account and resource accessed, and the identity in use. For data operations, we also need to understand what the output is and where this output is routed.

There’s a lot that goes into a proper decision about the validity of an action.

In most agent harnesses, local commands, file operations, skills, and delegation are also tool calls. They matter because of where they lead. For example, reading ~/.aws/config is how the agent finds an admin profile to use.

So enforcement at the tool call is critical, and so is deciding on the action inside it.

Where enforcement can happen

Some of the damage can be prevented through reasoning checks that assess a plan or action against the task at hand. But this is a probabilistic control, and some malicious instructions will pass through. There’s no good alternative to having proper mitigation controls that can stop an action.

These methods overlap and complement each other. A hook that calls a policy service and a gateway that consults an identity graph do a better job because the enforcement and decision points are in the locations best suited to them.

This table is far from exhaustive, and there are more considerations for some of these methods. Take managed settings, for example. Model and effort settings are behavioral in nature, but with some harnesses, permissions are much more than a prompt saying “please don’t flip out”.

In Claude Code, for example, permission rules are enforced by the application itself, and managed settings can restrict user overrides. In that case, control lives in a settings file, but that doesn’t make it less effective.

With hooks, the basic premise depends entirely on their placement in the execution chain. You can’t stop an event that’s already happened, and failure behavior varies by hook types and events.

Gateways have their own complexities, as they must base their authorization decisions on what they see. Look at AWS AgentCore, which demonstrates policy checks for connected tools. Note which calls it sees.

Sandboxes and scoped credentials solve different problems. Proper isolation can remove access capabilities, whereas a scoped credential limits what happens after access is granted. See Cloudflare’s sandbox authentication design, which shows a way to add credentials outside the sandbox, so the agent doesn’t need to possess the secret. Its operations, though, will still require authorization.

Apply the same policy to a hosted agent

Consider a support agent that’s asked to summarize open cases. Its connector uses a service account built for agents that edit and close cases. The agent decides that some cases look resolved and tries to close them.

Again, the capability comes with the credential, and the agent is within its grant. The place where the action is disallowed is the agent’s approved read-only policy.

To enforce it, the policy must be something a control can check, such as: “This agent may read cases, and any call that edits or closes one is denied, regardless of the service account it holds.”

If that agent lives in a hosted environment, an endpoint control on the employee’s laptop might have no opportunity to stop the action, since it’s all server-side.

Here, you’ll need cooperation from the SaaS platform’s own controls, rely on a tool gateway, or have a narrower service identity. And again, it depends on what the platform exposes and where the calls run.

Which brings us to coverage gaps in our controls. There’s no one perfect control here. Hooks aren’t better than endpoint enforcement, which isn’t better than a sandbox. It’s all about what you deploy and where.

Two methods can stop both of these examples before the action reaches the target: a gateway that sees the relevant traffic and credential scoping at the target. The other methods depend more heavily on where the agent runs and what the runtime exposes.

Above all, you want the agent to keep working within its approved policy. Read-only is not complete. It can still expose sensitive data, depending on where the output goes. Anthropic’s containment analysis explains why.

Choose what’s practical, then test the ways around your control

You’ll likely be deciding what’s practical based on your deployment. Managed settings require supported clients and central administration, for example. And you won’t have hooks without a runtime that exposes the right events. Gateways force you to route traffic through them, and endpoint controls mandate software installation and maintenance.

None of these is free. The controls introduce trade-offs, require maintenance, and must account for an ever-growing volume of AI-driven work.

Take the AWS example from the beginning of the article. Blocking the literal command is a start, but what if the same request comes through an SDK? With a different credential? Through delegation?

The security requirement to block deletion remains the same, but there are many different paths to it.

Then there’s the question of value, and you have to consider it as much as the control capabilities. How much delay do the controls add? How often does someone need to unblock a false positive? Are we reducing risk or introducing problems?

SACR’s ARISE report centers on runtime intervention, delegated authority, and action-level decisions. This should be brought down to a concrete request, a policy, and evidence of what happened when the agent tried it.

A short guide, based on where your agents run and what you control there:

It probably isn’t one or the other. Instead, most organizations have all of the above, mixed together, with controls spread around different teams as well. Across these environments, the one common denominator is identity. So start with credential scoping at the target, as this dictates the reach wherever the agent is running. Then, add one policy source that every enforcement point reads from.

Do this, and you’re in a good starting position.

Where Token fits

At Token Security, we are building around the identity intelligence graph and the decisions it can support across the different enforcement points. Our current focus spans agent settings, gateways, endpoint enforcement, and APIs into identity and agent platforms.

The broader vision is to build or connect to the enforcement capability the customer needs. We don’t need to build everything ourselves.

The graph connects an agent to its owner, the identities it consumes, the permissions associated with those identities, and the resources it can access. That’s the kind of context that policy engines can use to decide what an agent may do, rather than assuming that the credential’s full authority is appropriate.

In a recent gateway demo, we demonstrated this exact idea: same developer, same session, and the agent’s call is denied on admin and allowed on readonly. Other controls can enforce read-only access, too.

Supplying the right identity context and applying the policy across the different places agents work is paramount, yet complex, as this process requires reliable attribution. If we cannot distinguish the agent’s request from a human using the same credentials, the graph doesn’t magically fix it.

What about baselines? Keep in mind that past behavior can only be used as an input, not the policy itself. The fact that an agent usually just reads data does not prove that a write is forbidden. That’s the job of the rule that pins agents to readonly. Missing or stale context also requires an explicit decision, as with hook timeouts.

I want an agent to complete the investigation or the support summary without requiring approval for every step. I also want to know exactly where an action outside that task will stop. That’s what I would ask of every enforcement method, including Token Security.

Check us out or book a demo if you’re also solving these AI security problems in your organization.

Sponsored and written by Token Security.

Here’s what I’d focus on when buying a blower for leaf cleanup:

Volts: In the cordless power-tool arms race, leaf blower batteries range from 18 to 80 volts. Some of that difference is marketing trickery: an advertised 20-volt max battery or tool delivers essentially the same power as an 18-volt model, and the same goes for 36- and 40-volt options. But, unless you’re a minimalist who wants one battery to power everything from a drill/driver to lawn and garden gear, you’ll probably be happier with a leaf blower that uses at least a 36-volt battery. A few capable 18-volt blowers use two batteries—either simultaneously to mimic the power of a 36-volt tool or in succession to increase the runtime—but they tend to cost more and only make sense if you already own the batteries. For smaller jobs, though, a standard, single-battery 18- or 20-volt blower may be all you need to clear a patio, clean out the garage or shed, or dry a car.

Amps: Volts get most of the marketing attention on the box, but a battery’s amp-hour rating tells you more about how long a blower runs. Think of voltage as the car’s engine and amp-hours as the size of the gas tank—you want to know both. Batteries with higher amp-hour ratings cost more than otherwise-similar battery voltages, and they tend to be heavier. For leaf blowers, manufacturers typically pair kits with batteries rated from 4 to 8 amp-hours. You can buy higher-capacity batteries separately, and it pays to know the range of options a manufacturer has. A battery with a higher amp-hour typically takes longer to charge.

Systems: Underestimating the range of tools a battery can power in pursuit of “the best” is, in my opinion, a mistake. Often, the difference between two top-performing tools is negligible, and with cordless power tools, that difference often comes down to runtime, which you can address with a higher-capacity battery. If your garage is already stocked with one brand’s outdoor power equipment (OPE), it makes sense to stay within that platform and buy the blower as a bare tool, leveraging the batteries you already have. Switching brands just to buy “the best” probably isn’t worth it to introduce a whole new battery and charger.

If you’re new to OPE—and a leaf blower is a common first purchase—the breadth of tools that share the battery matters. Some manufacturers stick to the lawn and garden basics, so one battery can power a blower, mower, string trimmer, and hedge trimmer, while others offer a much wider range of tools, from log splitters to snow blowers, and even some handy lifestyle products like portable power stations. Before buying, consider what else you can power with the battery that comes with your leaf blower because, chances are, lording over leaves won’t be your only lawn and garden chore.

Traditional 18-volt power tool manufacturers—the ones who make drill/drivers and circular saws—all offer leaf blowers and the simplicity of a one-battery platform, but they’re not powerful enough to replace a gas unit. Ryobi, for example, uses 18-volt batteries across its traditional power tools, and some outdoor equipment, but its most capable gas alternative options run on 40-volt batteries.

Detent clasp: Blowers have two or more connection points: where the tube meets the housing and where the nozzle attaches to the tube. Look for models with a detent at those junctions—a small, often brightly colored spring-loaded clip that snaps into place with a satisfying click when the parts connect. I find these connections hold more securely and last longer than simple friction-fit attachments.

Stubby nozzle: Recently, blowers aimed at car detailers, with short tubes and sometimes a pistol grip, have become popular. Manufacturers responded by adding a stubby, 3- to 6-inch tube that the main blower attachment slides over. When you remove the longer tube, this short one works to direct the volume of air with an overall shorter tool length that’s easier to use around cars or in tight spots (the blower’s nozzle doesn’t fit on this stubby tube, though, so you lose some velocity).

What I’d Worry Less About:

Weight: Across the board, regardless of voltage, a good battery-powered blower will weigh about 10.5 pounds with the battery attached. If you need a lighter option, look for an 18-volt powered blower. Some have better balance than others, meaning that when you hold them without squeezing the trigger, as you would while walking around, the tool stays mostly level or the nozzle end tips down a bit. These models will cause less fatigue than one that forces you to rotate the nozzle upward. With the former, you only need to make a slight horizontal twisting motion to spread the stream of air. Most modern leaf blowers also draw air in a straight line through the rear of the tool, unlike gas-powered models with intakes mounted to the left or right of the engine. Those offset intakes can create a twisting motion that increases hand fatigue and may even suck in your pant leg.

CFM, MPH, and Newton: This sounds counterintuitive, considering how much marketing goes into boasting about a leaf blower’s cubic feet per minute (CFM) and MPH, but these figures are a guide, not necessarily the only reason to buy a specific model. A blower needs both to be useful: CFM tells you how much air it moves, while MPH tells you how fast that air is moving. But there’s no universally adopted testing method for these specifications when it comes to battery-powered blowers (ANSI/OPEI B175.2, the standard test on the books, applies only to internal combustion engines). That means brands can test their units differently — for example, measuring MPH where the motor meets the tube rather than at the end of the blower tube, which gives you a better sense of the airspeed you’ll actually get in use. Some CFM numbers are also measured with the unit running in its max, boost, or turbo setting, rather than on high speed.

Newtons, a unit of force, is a rating that’s appearing more frequently on the spec sheets of higher-voltage, battery-powered leaf blowers and is the best apples-to-apples comparison of blowing power. However, because there’s no testing code for battery-powered leaf blowers, reporting newtons is optional and, like CFM and MPH, consumers have no way of knowing whether the test is standardized. Generally speaking, a good midrange blower will produce around 20 newtons, while models that produce more are typically higher-performing units. Treat newtons as a guide rather than a definitive specification while buying.

Wide nozzles: Some blowers come with a wide-tip nozzle, which can be useful for clearing paved surfaces like patios and driveways or blowing water off flat surfaces. But in practice, it’s not enough of a game changer to be a deciding factor. The narrower nozzle is typically what you’ll use, and you can twist your hand back and forth to create a wider pattern when needed.

Photograph: Sal Vaglica

Most people treat a phone that looks like it lost an argument with traffic as scrap. LastComputer paid about forty dollars for one anyway. The listing came to 1,700 Ukrainian hryvnia, and a carrier lock kept the price down because nobody was going to drop a SIM in it again. This Samsung Galaxy S23 arrived bent in half, back cover smashed, battery squished, and still willing to boot.

The desire to save that board was what made it worthwhile to salvage. At the heart of it is a Snapdragon 8 Gen 2, a seriously strong eight-core processor paired with an Adreno 740, the same type of chip found in some high-end handhelds costing five, six, or seven times as much. The vapor chamber was originally developed with a thin phone in mind, not a beast sitting on your desk for hours at a time, but abandoning that piece of silicon to accumulate dust would have been the true tragedy. Turning it into a desk machine was a bit of a compromise; you had to accept that the case was already ruined and concentrate on getting any useful bits to function.

Sale

Samsung Galaxy Z Fold8 Unlocked Android Smartphone, 256GB Lavender

• CREATED FOR YOUR CONTENT: Any way you turn it, the new Galaxy Z Fold8 gives you a fuller viewing experience. Designed with your content in mind, this…
• WORLD’S LIGHTEST FOLD¹: Galaxy Z Fold8 is the newest foldable phone for content on the go. Unfolded, it fits movies and books for an immersive…
• THE BRIGHTEST DISPLAY ON A GALAXY PHONE: Our brightest smartphone display² provides you with a comfortable view, whether you’re inside or outside…

Taking it all apart began with a hot air gun and a plastic card to coax what remained of the cover off. The charging circuit, ribbon connections, and mainboard all popped right out, along with the display, as an external monitor had always been the goal. Getting the frame back into form required some TLC with a hammer, as the trick was to flatten the bend without damaging the vapor chamber. A new battery was on the order list because I knew the board wouldn’t boot up without one. The original battery had somehow managed to keep a charge despite being a bit of a bent up mess and a terrible thing to leave running on a case you intend to leave on.

The next issue was storage, as 128 gigabytes on the phone is simply not enough for all of the PC games he wanted to try; It’s fine for applications and things, but for a proper PC gaming setup, it’s laughable. So he used a SATA-to-USB adaptor to install a 512 gigabyte Team Group SSD, giving me some breathing room. The enclosure is a 3D printed phone shell that was hot-glued to a small SSD cage and left open to let heat out. Two USB hubs handle all of the wiring: one for powering and transmitting HDMI as well as a data port, allowing Samsung DeX to drive a monitor, and another for the drive and a small fan.

Cooling is what truly sets this apart between a fast demo and a full-on gaming session. He utilized thermal paste and hot glue to attach a northbridge heatsink to the top of the vapor chamber. A 40-millimeter fan, which is an appropriate size for this type of application and can run on five volts, is secured down to keep it in place and operational. When compared to the phone’s original cooling system, it lowers temperatures by approximately seven degrees Celsius. The final consequence is also clear, as the processor runs at full power for longer periods of time, and the throttling that used to shorten my gaming sessions has all but vanished.

So Samsung DeX gives me a desktop view. Simply plug in the hub, connect a monitor, mouse, and keyboard, and the phone will abandon its phone home screen and go to Windows. Dolphin allows GameCube titles to run smoothly. Even my God of War II using a PS2 emulator performs admirably, despite the fact that this is a particularly difficult test for this type of gear. PC games are played using GameHub, where he can import his Steam collection or run GOG installs stored on the SSD. Some titles still require a controller, while others require you to configure the appropriate driver settings before launching.
[Source]