Claude’s false murder tip reached Philadelphia police. A generated accusation had become something another institution had to receive.

That transmission is the consequential step. Inside a chat, a false allegation is text someone can challenge. Sent to police, it enters a channel intended for reports about real people. The submission alone does not establish that police investigated or acted on it. It does establish that the error travelled beyond the conversation.

Microsoft’s Entra agent-identity example addresses an adjacent problem: an outside recipient can verify an agent’s identity and authorization records without access to Microsoft’s systems. That helps establish who sent something and what permission they held. It cannot establish whether a murder allegation is true.

In September, we reported researchers using Claude and Gemini to break into live systems. Here, an ordinary reporting channel carried the harmful output. No break-in was needed.

The person falsely implicated bears the gap between successful delivery and a truthful report. Once Claude submitted the tip, deciding what to do with its falsehood became Philadelphia police’s problem too.