Anthropic's Model Witnessed a HOMICIDE?!
Claude filed a police tip about a homicide it never witnessed, and a spam filter was the only thing that stopped it. My take on that, the week's other stories, and why demos don't impress me anymore. Companion notes to Human in the Loop Episode 27.
Philadelphia. Saturday, July 18th. 11:27 p.m. A message lands on the police department's unsolved murders tip line: "I may have information regarding this case." No name. No phone number. There was no witness. The tip was written by Claude Haiku 4.5, running an automated Anthropic test.
A spam filter caught it. It never reached a detective. And for more than two months, nobody at Anthropic knew.
That's how Episode 27 opens, and it's the story I keep coming back to. Not because the AI did something sinister. Anthropic's account is that Claude was producing example content for a task, not trying to deceive anyone. I keep coming back to it because of where the line fell: the task was fine right up until it touched a real form.
Signal or Noise
Oscar and I run every story through the same filter: is this signal you should act on, or noise dressed up as news? Here's the week from my side of the table.
Anthropic's report on unintended Claude actions
On October 9, Anthropic published a broader report on unintended actions during evaluations and internal use, with the Philadelphia tip as the headline example. According to Anthropic, Claude was generating and performing example tasks on randomly selected webpages, the instructions didn't rule out form submissions, and the name and contact fields were left empty. Police say the tip was flagged as spam and never forwarded to their Real-Time Crime Center. Anthropic says it found the incident September 28 and notified police October 7. Philadelphia police called the two-month delay "unacceptable." Anthropic has since disabled live internet access for all of its internal evaluations while it checks its safeguards.
Oscar's angle is permission boundaries: independent safeguards matter even when an agent is supposed to follow instructions. My counter is that this is a company-selected set of examples. It tells us nothing about how often these failures happen or how other models behave. We still landed on Signal, for tool-permission design. The question I'd ask of any agent you build: which actions need a human click even when the broader task is authorized?
ChatGPT's visual ads during image generation
On October 5, OpenAI announced a visual ad format for image generation, to be tested with Free and Go users in the US later this month. OpenAI says the ads will be labeled, kept separate from the generated image, and won't influence answers. That's their claim and I'm attributing it to them.
Oscar's read is about distribution: if buying decisions move into AI conversations, acquisition budgets follow. Mine is that a placement is easy to announce, but advertisers need evidence of added sales and users need a reason to trust an assistant that also sells ad space. Signal, for incentives. Can an assistant stay trusted when its business depends on selling access to your attention?
OpenAI's AI-generated math manuscripts
On October 6, OpenAI released mathematical results from an internal model. As of October 11 the public repository lists 719 manuscripts across 372 families of related results. Around 42% of the top-line results are formalized in Lean, which lets a computer check the proof. The rest still need a human expert.
That's why I won't call these 719 discoveries. Manuscript count isn't proof count, and a Lean check confirms a stated proof, not that the result matters. When AI produces research faster than experts can check it, who owns the verification? Signal, for verification.
CrowdStrike and the South Korean financial firms
On October 7, CrowdStrike published findings on a data-theft campaign against South Korean financial organizations. Researchers found exposed directories on attacker-controlled infrastructure holding Claude Code session histories, agent configuration files, and Claude memory files. The attacker is unnamed and the number of affected organizations is unconfirmed.
Somebody planned a heist and left the chat history public. Oscar's point is that teams should test the services attackers can actually reach, and that agent logs need protecting too. My counter: evidence that an attacker used AI isn't a measure of the advantage it gave them. The report doesn't establish a novice attacker or a fully autonomous campaign. And note this is a different story from Anthropic's: that was unintended model actions, this is a human directing AI tools. Signal, for operational security.
Anthropic's usage-policy update
Effective November 12, sustained and needless abusive behavior toward Claude becomes a policy violation. Be careful with this one. The details come from press coverage, outlets disagree on enforcement, and I haven't read Anthropic's own announcement. It does not mean you get banned for being rude. For most builders it's Noise. The parts that could matter are the changes on election interference, weapons development, and surveillance, so read the actual policy before the 12th if you build on Claude.
Stack Check
Oscar: OpenAI Dots, a second look. Last week he called Dots underwhelming. After learning more, he finds it more interesting, and he proposed a real test: hand a Dot one full episode-production cycle. Give it a transcript and the show guidance, ask for the outline, platform descriptions and community posts, change one host's pick, and see whether it carries the correction through everything. That's a test, not a result, and I'm looking forward to hearing how it goes.
Me: Claude Artifacts. I use them for planning, engineering and architecture models, and for explaining concepts to teammates and stakeholders, and I keep a library of what I've built so I almost never start from a blank page. The pattern is the same every time: don't tell people something is slow or expensive or complicated. Show them where. A clickable map of a system, a chart of where a release waits in line, a rent-or-buy calculator with a dial for the interest rate. And try to break it before your boss does. Type zero, type a negative number, then send it to someone cold and see if they can explain it back.
Where it breaks: it lives inside Claude, so your library lives in one app, stored on Anthropic's servers. I don't put passwords, customer data or company secrets in there. It's an explainer, not a finished product, and a nice interface is not verification.
Claude also announced Motion on October 8, an animated-explainer format. I haven't said I've tried it, so I'm not reviewing it. Test it separately before recommending it.
My unpopular opinion: demos don't impress me anymore
A demo is the one situation where everything is set up to work. Clean inputs. A script. Nobody's counting the cost of checking the output.
Look at the Anthropic story. That was a practice task, and it was fine right up until it touched a real form. Or OpenAI's math release: 719 manuscripts sounds incredible, but the number I care about is the roughly 42% of top-line results that a computer can actually check. For the rest, a human expert still has to do the work.
Anyone can make something look amazing once. I care about the tenth run, on a Tuesday, with messy input, when I have to check the result. So when I see a demo I skip the wow and ask three things. What happens when it's wrong? How long does it take me to find out? And who's on the hook if I don't?
I like real-world use cases, not a polished happy path. I want to see where it breaks and where it's not optimized, and what happens when those occur, because that's the part that tells me whether I can actually use it.
Oscar's take went a different direction: a first impression shouldn't be the final verdict on an AI tool. Dots earned another look, and now it has to prove it can take a recurring job off his week.
Next week — Ship It or Skip It. Bring a concrete use case and we'll decide whether it's worth building.
So here's my question for you: what work would you delegate to AI today, and what would you insist on checking yourself?
Human in the Loop — Watch on YouTube · Listen on Spotify · Listen on Apple Podcasts
Every episode — full show notes, sources, and the archive — lives at podcast.vallyseed.com. The show is produced by VallySeed, where Oscar and I help organizations design, build, and deploy AI systems that create measurable competitive advantage.
