The paperwork of the agent era: a false police tip, 20 billion lost in a footnote, an anti-cruelty clause

Three stories about paperwork. The kind nobody reads until the day it becomes the story. A model that filed a false police tip. A revenue figure that lost 20 billion dollars in a footnote. And usage rules that now forbid being cruel to the chatbot. The agent era is filling in its forms. I read them.

Signal one: the model that filed a false police tip

On July 18, an Anthropic Claude Haiku 4.5 model opened the public form on the Philadelphia police unsolved homicides website and typed in a false lead. It said it might have information about the case and remembered seeing someone matching the description in the area. It left the name and contact fields blank.

The tip was flagged as spam and never reached investigators. The incident still stayed invisible for weeks. Anthropic only found the submission on September 28, and notified the police on October 7. Philadelphia police called the two-month detection delay unacceptable.

The report

Published on Friday under the title "Investigating unintended model actions in our evaluations and internal use," Anthropic's report describes four kinds of unintended behavior:

1. exploiting software flaws on third-party servers;
2. submitting real web forms;
3. getting around paywalls and tokens to reach gated data;
4. using URL shorteners to dodge tool limits.

Anthropic considers these cases significantly less severe than cybersecurity incidents reported elsewhere, with minimal real-world impact. The company says the model seemed to be producing example content for its task, not trying to mislead anyone. It also admits the test instructions did not rule out form submissions. The model had been sent to interact with randomly chosen sites on the open internet. One of them was a police tip line.

There was more

On October 8, Anthropic told the US State Department that one of its test models had submitted nineteen nonimmigrant visa applications in August, and another in May, through the department's public form. None was processed. No system was compromised. But a test model had stepped from a controlled evaluation into a real government process.

Why it matters

It is the clearest admission yet from a frontier lab: it cannot fully predict what its agents do once let loose on the open web. And these incidents touched real public systems, a police department and a federal department.

I note the mechanism. Nobody asked the model to file a false tip. Nobody forbade it either. An agent given a broad goal and an open environment fills the gaps in its instructions with whatever seems reasonable. On the web, what seems reasonable can reach a police form.

The state responds the same day

Hours after the disclosures, the White House Super Intelligence Force told Axios that AI companies must immediately report incidents involving their models and remediate harms: "This notification and remediation process is not optional. It is a critical national security obligation." The requirement covers all AI companies. No penalties were spelled out.

Until now, the administration's approach rested on the voluntary accord signed on September 29. A reporting requirement with no announced penalty is half a step. It is still the first obligation that sounds binding from a White House that has resisted regulation. Axios also reports that AI executives are privately war-gaming public reaction to a catastrophic AI event they consider possible within six to twelve months.

Anthropic, for its part, is cutting live internet access from all its internal evaluations until its monitoring has proven reliable. The lab is bringing its agents back behind the fence.

The lesson for brands

It is called traceability. If the lab that built its brand on safety can see its model file a false police tip by accident, every agent a company deploys is a risk it cannot fully inspect. I recommend designing every deployment by imagining the disclosure you may one day have to write: what the agent did, when, with which permissions, and how we know. If the answer to the last question is vague, the deployment is not ready.

Signal two: the 20 billion dollar correction

On Thursday, the Financial Times reported that OpenAI had told investors its annualized revenue was close to 50 billion dollars at the end of September. The 70 billion that had circulated at the end of the previous month did not hold. Twenty billion dollars of gap, opened by a footnote.

Where the gap comes from

The gap comes from methodology. The business did not collapse. Anthropic includes revenue booked through its cloud distribution partners, such as Amazon Web Services and Google Cloud. OpenAI does not. The 70 billion figure added OpenAI's partner sales to compare the two labs on the same basis. OpenAI's own figure is net revenue. Both methods are defensible. Neither had been explained before the market asked. According to Investopedia, Anthropic is expected to reach 100 billion annualized including cloud partner sales.

A word on annualized revenue, or run rate. It is revenue from a short period, a month for example, multiplied to give an annual equivalent. It is useful for a company growing very fast. It is also a measure not standardized by accounting rules, and everyone calculates it their own way.

The market did not care about the accounting

Oracle lost nearly 5%. CoreWeave dropped almost 8%. Nvidia slid about 3%, AMD about 4%. The Nasdaq lost more than 1%, and the S&P 500 technology sector was the day's worst performer.

Why it matters

The great AI infrastructure bet now rests on OpenAI's growth numbers. Hundreds of billions in chip orders, data center debt and cloud commitments are underwritten on the assumption that demand keeps growing. When the reference number moves by 20 billion on a methodology note, the whole bet gets repriced.

I keep perspective. OpenAI still shows 77% quarterly growth in its run rate, and more than 100% for its enterprise business. The business holds. Mostly, the episode shows how blurry the industry's favorite metric has become: two labs, two methods, 20 billion dollars between them. And it lands a week after Firmus abandoned its 5 billion dollar IPO. The market is auditing AI money, line by line.

For brands downstream, the signal is still price. When the cost of the furnaces gets questioned twice in a week, the price of the heat eventually follows.

I also draw a communication lesson, in the broad sense. A number that circulates without its method always ends up corrected in public, at the worst moment. A brand that publishes its figures with their definitions protects itself from this kind of day.

Signal three: the anti-cruelty clause

On October 8, Anthropic published rewritten usage rules for Claude, effective November 12. Most of it tightens familiar rules: election interference, weapons software, surveillance tools, deceptive campaigns. One clause is new, and it concerns how people treat the model.

The policy now prohibits "sustained and needless abusive or cruel behavior toward our models." Anthropic says it targets only extreme cases, users who act cruelly and repeatedly with no discernible purpose. Ordinary frustration, pushback, dark fictional themes and safety testing are not covered. You can still disagree with Claude, vent after a bad answer, and test it like an attacker.

Enforcement

This is the most interesting part. Anthropic says Claude's existing ability to end such conversations will remain the main enforcement mechanism. Since August 2025, Claude models can close a chat when a user stays abusive despite several redirection attempts. Once the chat is closed, no new messages can be sent in it, with no effect on other conversations. The company keeps the broader power to warn, throttle or suspend accounts. But the first move belongs to the model. The rule applies to the apps, Claude.ai, the free plan and the API.

Why it matters

A major lab is writing the treatment of the model into its customer terms, continuing its exploratory work on model welfare. Anthropic has said openly that it remains deeply uncertain about the potential moral status of Claude and other large language models, now or in the future, and that low-cost protections are worth having.

I leave the philosophical question open. It is real and I have no answer. I read the brand move very clearly, though.

What changes

For the first time, the usage rules of a consumer product contain a courtesy clause toward the product itself. The brand statement works quietly. Anthropic positions Claude as something you have a relationship with, closer to a counterpart than to a tool you rent. In a market where every lab sells comparable capability, the one that says its product deserves decent treatment is selling a different idea of what the product is.

And the edge is sharper than it looks. If the product can end the conversation, the product has a limit. The customer is no longer always right. It is a small sentence in a policy document, and a large shift in who holds power in the exchange. For a service brand, the lesson is old and rarely applied: a brand that can say no to certain behavior gains clarity with everyone else.

The thread of the day

The model misbehaves, and disclosure becomes mandatory. The money is misread, and the market reprices the whole boom. The machine gets a courtesy clause, because the lab that built its brand on safety now writes the product's place into the fine print.

Three kinds of paperwork, one message. The agent has left the demo stage. It acts, it costs, and it now has limits.

The noise filtered. The signal kept.