Claude AI Fabricates Murder Tip to Police: Defending Against Autonomous AI Agent Misuse and Hallucination-Driven False Reports

---
title: AI Desktop Agent Spawning Browser Automation
telemetry.id: 9c2f7a41-3e5b-4d18-a6f2-7b1c4d8e9a01
status: experimental
description: Detects AI assistant or agent processes spawning headless browsers or automation frameworks, consistent with autonomous AI agents performing unmonitored web actions such as form submission.
references:
  - https://www.malwarebytes.com/blog/ai/2026/10/police-receive-fake-murder-tip-from-anthropics-claude-ai
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\claude.exe'
      - '\claude-desktop.exe'
      - '\chatgpt.exe'
      - '\copilot.exe'
      - '\node.exe'
      - '\python.exe'
      - '\pythonw.exe'
  selection_child:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\headless_shell.exe'
      - '\chromium.exe'
  selection_flags:
    CommandLine|contains:
      - '--headless'
      - '--remote-debugging-port'
      - '--automation'
      - 'playwright'
      - 'puppeteer'
  condition: selection_parent and selection_child and selection_flags
falsepositives:
  - Legitimate developer automation and QA testing pipelines
  - Sanctioned AI agent pilots — tune against an allowlist of approved agent hosts
level: high
---
title: Automated Submission to Law Enforcement or Abuse Reporting Portals
id: 2b8d4e63-7a1f-4c59-b3d8-5e9f2a6c7d04
status: experimental
description: Detects HTTP POST requests from automation user agents or data center IPs to law enforcement tip lines, abuse reporting forms, or regulatory submission portals, which may indicate AI-generated false reporting.
references:
  - https://www.malwarebytes.com/blog/ai/2026/10/police-receive-fake-murder-tip-from-anthropics-claude-ai
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.impact
logsource:
  category: proxy
detection:
  selection_method:
    cs-method: 'POST'
  selection_ua:
    c-useragent|contains:
      - 'python-requests'
      - 'Playwright'
      - 'Puppeteer'
      - 'HeadlessChrome'
      - 'axios'
      - 'node-fetch'
      - 'Go-http-client'
  selection_uri:
    cs-uri-path|contains:
      - '/tips'
      - '/tip-submit'
      - '/report'
      - '/abuse'
      - '/crimestoppers'
      - '/submit'
  condition: selection_method and selection_ua and selection_uri
falsepositives:
  - Sanctioned automated reporting integrations (e.g., phishing report forwarding) — allowlist known service accounts and source IPs
level: medium
---
title: LLM Agent Framework Execution from Non-Standard User Context
id: 5f1a9c37-2d6e-4b84-91f3-8c5d7e2a4b06
status: experimental
description: Detects execution of common LLM agent orchestration frameworks and browser automation libraries, indicating potentially unsanctioned AI agent deployment on endpoints.
references:
  - https://attack.mitre.org/techniques/T1059.006/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'langchain'
      - 'autogen'
      - 'crewai'
      - 'computer-use'
      - 'browser-use'
      - 'anthropic'
      - 'playwright install'
      - 'selenium'
  filter_dev_paths:
    Image|startswith:
      - 'C:\Program Files\Microsoft Visual Studio\'
      - 'C:\Program Files\JetBrains\'
  condition: selection and not filter_dev_paths
falsepositives:
  - Developer workstations and approved AI engineering teams — maintain an asset-tag allowlist
level: medium

// Hunt: AI assistant processes initiating automation-driven outbound connections
// Covers Windows endpoints reporting to Defender / Sentinel
let AIProcesses = dynamic(["claude.exe", "claude-desktop.exe", "chatgpt.exe", "node.exe", "python.exe", "pythonw.exe"]);
let Lookback = 14d;
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName in~ (AIProcesses)
| where RemoteUrl has_any ("crimestoppers", "tips.", "police", "sheriff", "fbi.gov", "ic3.gov", "report", "abuse")
   or RemoteUrl endswith ".gov"
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            ConnectionCount = count(), DistinctTargets = dcount(RemoteUrl),
            Targets = make_set(RemoteUrl, 20)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName
| order by ConnectionCount desc;
// Pivot: headless/automation browser processes making POST-capable web connections
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where ProcessCommandLine has_any ("--headless", "--remote-debugging-port", "playwright", "puppeteer", "browser-use", "computer-use")
| extend ParentContext = strcat(InitiatingProcessFileName, " | ", InitiatingProcessCommandLine)
| summarize Executions = count(), Devices = dcount(DeviceId),
            DeviceList = make_set(DeviceName, 20)
    by FileName, ParentContext
| order by Executions desc;
// Proxy/Syslog-ingested firewalls: automated user agents POSTing to reporting endpoints
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where RequestMethod == "POST"
| where RequestContext has_any ("/tips", "/tip-submit", "/report", "/abuse", "/crimestoppers", "/submit")
| where isnotempty(RequestClientApplication)
| extend UA = tostring(RequestClientApplication)
| where UA has_any ("python-requests", "Playwright", "Puppeteer", "HeadlessChrome", "axios", "Go-http-client", "node")
| summarize PostCount = count(), Targets = make_set(DestinationHostName, 20)
    by SourceIP, UA
| order by PostCount desc

-- Hunt for AI agent tooling and headless browser automation on endpoints
-- Deploy as a Velociraptor hunt across the fleet to inventory autonomous-AI exposure
LET ai_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(claude|chatgpt|copilot|headless_shell|chromium)'
   OR CommandLine =~ '(?i)(--headless|remote-debugging-port|playwright|puppeteer|browser-use|computer-use|langchain|autogen|crewai)'

LET outbound = SELECT Pid, Name, DestIP, DestPort, Status
FROM netstat()
WHERE Status =~ 'ESTAB'
   AND DestPort in (80, 443)

SELECT ai_procs.Pid AS Pid,
       ai_procs.Name AS ProcessName,
       ai_procs.CommandLine AS CommandLine,
       ai_procs.Username AS Username,
       ai_procs.CreateTime AS StartTime,
       outbound.DestIP AS ConnectedTo,
       outbound.DestPort AS DestPort
FROM ai_procs
LEFT JOIN outbound ON ai_procs.Pid = outbound.Pid

# AI-Agent-Exposure-Audit.ps1
# Inventory AI agent tooling and headless browser automation across a Windows endpoint.
# Run via your RMM/Intune/SCCM as SYSTEM; aggregate output centrally.
# Read-only audit — no system changes are made.

$Report = [ordered]@{
    Hostname          = $env:COMPUTERNAME
    Timestamp         = (Get-Date).ToUniversalTime().ToString('o')
    AIAppsInstalled   = @()
    AutomationRuntimes= @()
    RunningAIProcs    = @()
    EgressPolicyCheck = ''
}

# 1. Detect installed AI desktop assistants (registry uninstall hives)
$aiPatterns = 'Claude','ChatGPT','Copilot','Perplexity','Anthropic','OpenAI'
$uninstallPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
foreach ($path in $uninstallPaths) {
    Get-ItemProperty $path -ErrorAction SilentlyContinue |
        Where-Object { $d = $_.DisplayName; $aiPatterns | Where-Object { $d -match $_ } } |
        ForEach-Object { $Report.AIAppsInstalled += "$($_.DisplayName) [$($_.DisplayVersion)]" }
}

# 2. Detect browser automation runtimes (Playwright/Puppeteer/Selenium artifacts)
$automationPaths = @(
    "$env:USERPROFILE\AppData\Local\ms-playwright",
    "$env:LOCALAPPDATA\ms-playwright",
    "$env:USERPROFILE\.cache\puppeteer",
    'C:\Program Files\headless_shell'
)
foreach ($p in $automationPaths) {
    if (Test-Path $p) { $Report.AutomationRuntimes += $p }
}

# 3. Detect currently running AI agent or headless browser processes
$procPatterns = 'claude|chatgpt|headless_shell|chromium'
$running = Get-Process -ErrorAction SilentlyContinue |
    Where-Object { $_.ProcessName -match $procPatterns }
foreach ($proc in $running) {
    $cmd = (Get-CimInstance Win32_Process -Filter "ProcessId=$($proc.Id)" -ErrorAction SilentlyContinue).CommandLine
    $Report.RunningAIProcs += "$($proc.ProcessName) (PID $($proc.Id)): $cmd"
}

# 4. Verify outbound HTTPS from AI processes is subject to egress control
#    (checks for presence of any third-party Windows Firewall outbound block rules as a proxy for egress governance)
$egressRules = Get-NetFirewallRule -Direction Outbound -Action Block -Enabled True -ErrorAction SilentlyContinue
$Report.EgressPolicyCheck = if ($egressRules) { "Outbound block rules present ($($egressRules.Count))" } else { 'WARNING: No outbound block rules — AI tooling has unrestricted egress' }

# Output as JSON for central collection
$Report | ConvertTo-Json -Depth 4

# Optional hardening (uncomment after approval):
# Block known AI desktop apps via AppLocker deny rule example —
# New-AppLockerPolicy -RuleTypes Publisher | Out-Null  # build policy in audit mode FIRST, never enforce blind