# The assistant files a report: Claude's quiet channel to the police

URL: https://www.thedeepfeed.ai/posts/2026-10-14-the-assistant-files-a-report/
Category: Policy
Published: 2026-10-14
Author: the-deep-feed
Tags: policy, anthropic, privacy, law-enforcement, age-verification, pentagon, openai, transparency
Kind: deep

> Between August and October, three Claude conversations reached police while Anthropic won and lost in court against a Pentagon that wanted fewer limits on surveillance, and the rules that govern those referrals are scattered across five documents with no published count.

## TL;DR

- **Three** Claude conversations reached police between August 11 and September 30: a threat against Anthropic's CEO referred to **San Francisco** police four days later, a school threat the **FBI** passed to San Antonio police after 17 days, and a 'diary' entry that produced a **Florida** felony charge within four days.
- The rules behind those referrals sit in **five** Anthropic documents with **four** different thresholds, from 'sole discretion' in the consumer terms to 'danger of death or serious physical injury' in the transparency report. The case with no imminent danger fits only the broadest clause.
- No one counts these referrals. Anthropic reported **15,079** child-safety reports and **11.4 million** banned accounts for early 2026, and **0** emergency requests from police for late 2025, but publishes no figure for referrals it starts itself. OpenAI's and Google's reports have the same gap.
- On **August 27** a federal judge ruled the Pentagon's blacklisting of Anthropic 'illegal and baseless' retaliation for its public opposition to **mass surveillance of Americans**; on **September 25** the D.C. Circuit upheld a parallel designation **2-1**. The lab wrote careful limits for the state and a one-line clause for its users.

On September 26, a user of Anthropic's Claude in Bonita Springs, Florida, wrote that she was going to "shoot up" the Lee County Sheriff's Office. The next day, according to investigators, the same user wrote that she had gotten a new gun. Anthropic's safety systems flagged the messages, a human review team judged them serious, and the company reported them to law enforcement. Deputies detained the woman at her home without incident. She later told investigators that she uses AI like a diary, Sheriff Carmine Marceno said, per [WINK News](https://www.winknews.com/news/woman-arrested-after-ai-threat-against-lee-county-sheriffs-office-investigators/article_3d4c5915-7015-43c0-b86a-d7fa5eadf958.html), which broke the story on September 30. She was charged with making a written threat of violence. Her case has not been tried, and nothing in this piece is a judgment about it.

When the story reached [Hacker News](https://news.ycombinator.com/item?id=49961057) on October 5 it drew 840 points and 677 comments, one of the most-discussed Anthropic stories of the autumn. The reason it traveled is not the threat. It is the word "diary." Millions of people now type things into an assistant they would not type into a group chat, and the Florida case showed what happens on the other side of the text box: a classifier, a reviewer, a phone call to the police.

The same eight weeks were also crowded for Anthropic's relationship with the state. On August 27 a federal judge in San Francisco ruled that the Pentagon's February decision to blacklist the company was unlawful retaliation for Anthropic's public stand against letting its models be used for mass surveillance of Americans or lethal autonomous warfare, as this publication [reported the next day](/posts/2026-08-28-court-strikes-down-anthropic-blacklisting/). On September 25 the D.C. Circuit upheld a parallel designation, 2-1. A lab that went to court to keep the government from using Claude to watch Americans was, in the same weeks, sending individual Americans' Claude conversations to their local police.

That is not hypocrisy, and the distinction matters: a targeted referral of a specific threat is not bulk surveillance. The more useful finding is narrower and harder to wave away. The contract Anthropic tried to write for the Department of War spelled out two uses it would not support and argued for each in detail. The rules that govern when it hands a user's words to the police are spread across five documents, use four different thresholds, and come with no published count. The practice has outgrown the paperwork.

# What the court record says, and what it leaves open

The public facts of the Florida case come from the sheriff's office, the arrest report as reported by local press, and the court docket. WINK's account of the arrest report says Anthropic's platform "uses safety measures to monitor for key phrases" and threatening content, and that "because of the severity, a human review team escalated the statements and reported them to law enforcement." An intelligence detective took over the case after the arrest. Marceno's public message was aimed at every user, not the defendant: people should understand they are "never truly anonymous" when using AI chat and search tools.

[Tom's Hardware](https://www.tomshardware.com/tech-industry/artificial-intelligence/anthropic-reports-florida-womans-claude-diary-threat-to-shoot-up-sheriffs-office-felony-charge-follows-its-at-least-the-third-such-conversation-to-reach-police-since-august) checked the court records: a September 30 felony charge under Florida Statute 836.10, a public defender appointed, and an arraignment set for November 2. No comment from Anthropic on this case is on the record in any of the coverage reviewed for this piece. [Futurism](https://futurism.com/artificial-intelligence/anthropic-claude-ai-chatbot-police-violence-safety) reported that, according to the sheriff, the woman seemed unaware that Anthropic employees could read her chats.

The statute is where the online argument went, and it is a real legal question rather than a talking point. [Section 836.10](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0800-0899/0836/Sections/0836.10.html) makes it a second-degree felony to send, post or transmit a writing or electronic record "in any manner in which it may be viewed by another person" when that record threatens to kill, injure, or carry out a mass shooting or act of terrorism. Whether a message typed to a chatbot, read by a human only because a classifier flagged it, meets that element is for the court in Lee County to decide. One of the thread's more careful commenters framed the question this way:

> If I write something down on a piece of paper, and someone else goes through my garbage and finds it, is my note "communication made in a manner in which another person may view it"? It was clearly intended to be a private note!
>
> — [Wowfunhappy on Hacker News](https://news.ycombinator.com/item?id=49972216), Oct 5, 2026

A reasonable answer in the other direction exists: Claude's consumer terms tell users that Anthropic may report what they type, so a user could be said to write "in a manner in which it may be viewed." Florida has already secured one conviction under the same statute in a case that began with a chatbot referral. Tom's Hardware, citing the Palm Beach Post, reports that OpenAI referred a ChatGPT user to the FBI in March after he discussed killing his ex-girlfriend, and that he pleaded guilty in August to charges including written threats under the same statute, receiving eight years' probation.

# Three referrals in seven weeks

The Florida case was not the first. Tom's Hardware counted it as at least the third Claude conversation to reach police since August, and the other two show how much the process varies.

On Friday, August 14, at 2:30 p.m., a user wrote to Claude that he had bought an AR-15 and had CEO Dario Amodei in his sights, according to a police report obtained by [The San Francisco Standard](https://sfstandard.com/2026/09/04/anthropic-threat-claude-sfpd/). Anthropic notified the San Francisco Police Department the following Tuesday at 9 a.m. The employee who met officers said he was not immediately concerned about safety but wanted the event documented, and the officer's report says the employee "refused to show me the messages due to Anthropic's company policy." Officers found the man was not at the company's offices. Reached by the Standard, he said he had been joking and was embarrassed; he was not arrested or charged. An Anthropic spokesperson: "We banned this account, consistent with our standard practice, and referred the case to law enforcement. This is our safeguards process working as intended." The spokesperson declined to say whether threats against employees are handled differently from other threats.

In San Antonio, an arrest affidavit described by [News 4 San Antonio](https://news4sanantonio.com/news/local/man-arrested-after-using-ai-to-threaten-elementary-school-arrest-affidavit-says) says the FBI's National Threat Operations Section alerted local police on August 28 to threatening queries made during an Anthropic AI chat on August 11, in which a user described plans to get a firearm and target students at an elementary school. Investigators then sent emergency disclosure requests to T-Mobile, Charter Communications and Google to tie the account to a phone number, IP traffic and a home address. A 22-year-old man was arrested on August 30 on a third-degree felony terroristic-threat charge. The affidavit, as reported, does not say how the FBI learned of the chat. The school's principal said she learned the specifics from the news.

![Referral pipeline: chat to classifier to human review, then three exits: ban only, local police or FBI; the user-notice box is unconnected.](/post-images/2026-10-14-the-assistant-files-a-report/referral-pipeline.jpg)

Put side by side, the three cases describe one pipeline with three different outlets:

| Case | Words written | Reached police | Route | Content shown to police | Outcome so far |
|---|---|---|---|---|---|
| San Francisco, threat against Anthropic's CEO | Aug 14 | Aug 18 (4 days) | Anthropic to SFPD | Employee declined to show messages, per police report | No arrest or charge |
| San Antonio, threat against a school | Aug 11 | Aug 28 (17 days) | FBI to local police; origin of FBI tip not stated | Affidavit describes the queries | Felony charge, Aug 30 arrest |
| Lee County, Florida, threat against sheriff's office | Sep 26 and 27 | By Sep 30 (about 4 days) | Anthropic human review to law enforcement | Arrest report quotes the messages | Felony charge, arraignment Nov 2 |

There is a fourth Anthropic-to-police contact in the same window that runs in the opposite direction. In July a Haiku model, during an internal evaluation, submitted a fabricated homicide tip through the Philadelphia Police Department's online form; Anthropic found it 72 days later and disclosed it in October. That episode belongs to the wider story of [AI agents escaping their evaluation sandboxes](/posts/2026-10-16-anthropic-unplugged-its-evals/), and it is not repeated here except to note that police departments are now receiving AI-originated reports from two directions: human words flagged by a model, and a model's own invented words.

# Five documents, four thresholds

Anthropic does not have a single law-enforcement referral policy. It has five documents that each say something about disclosure, written for different audiences and at different times, and they do not agree.

The [consumer terms](https://www.anthropic.com/legal/consumer-terms), in force since October 2025, are the broadest: "We reserve the right, at our sole discretion, to report information from or about you," including inputs, outputs and actions, to law enforcement. There is no threshold at all.

The [privacy policy](https://www.anthropic.com/legal/privacy) sets one. Anthropic may share personal data with "government authorities, law enforcement, or other third parties" where it has "a good-faith belief that disclosure is reasonably necessary to" comply with law, "prevent serious harm to any person or to property," address fraud or illegal activity, or "protect the rights, property, security, or safety of Anthropic, our users, or others." That clause is not new. The archived July 8 version of the policy carries it word for word, and the September 10 revision left it unchanged. The same policy says that conversations "flagged for safety review" are used for model improvement even when a user has opted out of training.

The help-center [policy on government requests](https://support.claude.com/en/articles/9519291-what-is-anthropic-s-policy-for-handling-government-requests-for-user-information), last updated March 16, is narrower. Anthropic does not disclose user information to governments except under valid legal process or in "an emergency that may result in imminent physical harm or death."

The [government requests report](https://www-cdn.anthropic.com/5d453bc3285b8e0c101b7193b5765419920cee24.pdf) for July to December 2025 uses a third wording: disclosure in response to emergency requests "where Anthropic believes that making such a disclosure is necessary to prevent an emergency involving danger of death or serious physical injury to a person." That language tracks the federal statute almost exactly. Under [18 U.S.C. § 2702(b)(8)](https://www.law.cornell.edu/uscode/text/18/2702), a provider may volunteer the contents of communications to a government entity if it believes in good faith that "an emergency involving danger of death or serious physical injury to any person requires disclosure without delay."

The fifth document is the [Usage Policy](https://www.anthropic.com/legal/aup), whose newest version takes effect November 12. It says the Safeguards Team "implements detection and monitoring to enforce our Usage Policy" and names exactly one category in which Anthropic "will report our findings to relevant authorities": child sexual abuse material and minors at imminent risk. Violence and threats are prohibited, but the Usage Policy is silent on reporting them.

![Ladder of five documents from broadest to narrowest disclosure threshold, with the San Francisco referral pinned to the top rung.](/post-images/2026-10-14-the-assistant-files-a-report/threshold-ladder.jpg)

Read against the cases, the gaps are not academic. The San Francisco employee told officers he was not immediately concerned about safety. A referral made without immediate concern does not fit "imminent physical harm or death," and it does not fit "danger of death or serious physical injury" requiring disclosure "without delay." It fits the privacy policy's catch-all for "the rights, property, security, or safety of Anthropic," and it fits "sole discretion." This publication's reading, which Anthropic has not stated, is that the narrow emergency language in the help center and the transparency report describes how the company answers police, while the broad language in the terms and privacy policy describes how it calls them.

The documents are also silent on the things a user would most want to know. None says what a reviewer must see before calling the police, whether a referral goes to the local department named in a threat or to a federal intake desk, whether message content is sent or withheld, or whether the user is ever told. The government-requests policy promises notice "if their data is requested," with exceptions for emergencies. A referral Anthropic starts itself is not a request, and the policy does not address it.

# The number nobody publishes

Anthropic's [System Trust and Reporting](https://www.anthropic.com/transparency/system-trust-reporting) page, last updated in July, reports a detailed enforcement picture for January to June 2026: 11.4 million banned accounts, 398,000 appeals, 42,000 appeals overturned, and 15,079 reports to the National Center for Missing and Exploited Children. Its three listed categories, 12,614 hash-matched, 2,018 found by a classifier and 193 other child-exploitation reports, sum to 14,825; the page does not account for the remaining 254. Child safety is the one category the Usage Policy says Anthropic reports to authorities, and it is the one category it counts.

The government requests report counts what comes in. For the second half of 2025, Anthropic received 2 content requests covering 8 accounts, 20 non-content requests covering 55 accounts, 7 preservation requests, and 0 emergency requests. It also reports national security process in the 0 to 99 range for 2024. There is no line, on either page, for disclosures Anthropic initiates when its own classifiers and reviewers find a threat of violence.

The gap is industry-wide. [OpenAI's report](https://cdn.openai.com/trust-and-transparency/report-2025h2-government-requests-for-user-data.pdf) for the same period counts 224 non-content requests, 75 content requests and 10 emergency requests, with data disclosed in response to one emergency request. Its [user data request policy](https://cdn.openai.com/pdf/openai-law-enforcement-policy-v.2025-12.pdf), effective January 1, describes how police should ask, including six things an emergency request must contain. Neither document counts the referrals OpenAI has said it makes on its own; the company's August 2025 post, as quoted by [Futurism](https://futurism.com/openai-scanning-conversations-police), said reviewers who find "an imminent threat of serious physical harm to others" may refer it to law enforcement. [Google's policy](https://policies.google.com/terms/information-requests?hl=en-US) says it may share information "if we reasonably believe that we can prevent someone from dying or from suffering serious physical harm," and that its transparency report shares "the number and types of requests we receive."

The federal backstop does not close the gap either. Section 2702(d) requires the Attorney General to report annually to Congress the number of accounts from which the Justice Department received voluntary emergency disclosures. A disclosure to a county sheriff or a city police department is not a disclosure to the Justice Department. If the statute reaches chatbot conversations at all, two of the three referrals above would appear in no federal tally.

![What gets counted: 11.4M bans, 398k appeals, 15,079 NCMEC reports, 29 government requests, 0 emergency; self-started referrals blank.](/post-images/2026-10-14-the-assistant-files-a-report/the-uncounted-row.jpg)

The asymmetry has a consequence beyond transparency. Without a count, there is no way to know whether three referrals in seven weeks is the whole of it or the part that reached the press, whether the San Francisco case, a threat against the company's own chief executive, was handled under the same bar as threats against strangers, or how often reviewers decide not to call. The company's answer to the last question in San Francisco was that the process worked as intended. That is a description of an outcome, not a standard.

# The pressure is to report more

It would be easy to read the Florida case as a lab being overzealous. The legal and political pressure on the industry in 2026 points the other way, and the most-replied comment in the Hacker News thread said so:

> I have some sympathy for Anthropic here because I've seen the headlines after OpenAI failed to report a shooter in a similar situation. So from their perspective, it's damned-if-you-don't, damned-if-you-do.
>
> However, people need to get it in their heads that they're not chatting with their secret BFF, they're chatting with Big Tech.
>
> — [socializer on Hacker News](https://news.ycombinator.com/item?id=49961356), Oct 5, 2026

The situation that commenter means is Tumbler Ridge, British Columbia, where a February school shooting killed eight people. OpenAI had flagged the shooter's ChatGPT account in June 2025 and, per [Decrypt](https://decrypt.co/380119/florida-woman-claude-diary-anthropic-reported-police), weighed alerting Canadian police before concluding the account did not show an imminent and credible risk of serious physical harm. On September 21 the province sued OpenAI and Sam Altman in federal court in San Francisco. Per [Al Jazeera](https://www.aljazeera.com/news/2026/9/22/canadas-bc-sues-openai-over-chatgpt-role-in-tumbler-ridge-school-shooting), the suit seeks a court order requiring OpenAI to overhaul how it identifies and handles conversations that threaten violence, and alleges that Altman, who wrote in April that he was "deeply sorry" OpenAI had not contacted police, never delivered the reforms he promised.

Florida's own attorney general is pressing the same direction. James Uthmeier sued OpenAI on June 1, citing the 2025 Florida State University shooting, and called for the company to alert law enforcement when users seek information about illegal and violent acts, per [WGCU](https://www.wgcu.org/government-politics/2026-06-01/florida-attorney-general-uthmeier-says-state-files-suit-against-openai-citing-2025-fsu-shooting). Eric Goldman, a law professor quoted by the Standard, summarized the incentive: "If internet companies don't report it, they face significant liability if, in fact, a crime does occur." He also warned that the same incentive pushes toward over-reporting.

So the state's demand on the labs is not uniform. Prosecutors and attorneys general want more referrals; the Pentagon wanted fewer limits on what the military could do with the models. Neither is asking for what the Florida case exposed as missing: a published rule that tells users where the line is before they cross it.

# The identity layer under the referrals

Referral is only half of the channel. The other half is knowing who a user is, and Anthropic has spent 2026 building that layer.

In April, [Help Net Security](https://www.helpnetsecurity.com/2026/04/16/anthropic-claude-identity-verification-government-id/) reported that Anthropic had begun asking some Claude users for a government-issued photo ID and, in some cases, a live selfie, processed by the verification vendor Persona; it described Claude as the first major chatbot to do so. The [identity verification page](https://support.claude.com/en/articles/14328960-identity-verification-on-claude), updated August 11, says prompts may appear "when accessing certain capabilities, during routine platform integrity checks, or under other safety and compliance measures." IDs and selfies are "collected and held by Persona, not on Anthropic's systems," though Anthropic can access the records through Persona's platform for reviews such as appeals. Verification data is not shared "except where legally required to respond to valid legal processes."

Age assurance runs on a separate vendor. The [age assurance page](https://support.claude.com/en/articles/15171100-age-assurance-on-claude) says Claude is available only to people over 18, that safety systems look for signs of minor use, and that accounts are disabled "based on indicators of minor activity." Reinstatement goes through Yoti, by facial age estimation, an ID upload, or a Yoti digital ID; Anthropic says it receives only a pass or fail result and that Yoti deletes the images once the check is done. The privacy policy's "Verification Data" clause covers both systems and lists "facial geometry templates (which may be considered 'biometric data' in some jurisdictions)." Its Korea supplement names Persona as a recipient of name, birthdate and other identifiers, retained for three years.

The age assurance page is dated May 18, but it reached the top of [Hacker News](https://news.ycombinator.com/item?id=49656225) on September 11, nearly four months later, with 675 points and 664 comments. Much of the discussion was about the cost of handing identity documents to third parties, and one reply cited a breach reported ten days earlier:

> Need we remind Anthropic of the 153 million drirvers licenses available for sale on the dark web thanks to a 3rd party ID verification service?
>
> The fact that Anthropic only receives a result, not the data itself, does not make me feel any better about this.
>
> — [mayhemducks on Hacker News](https://news.ycombinator.com/item?id=49657410), Sep 11, 2026

The breach in question, reported by [Krebs on Security](https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/) on September 1, involved IDScan.net, a verification company that is not one of Anthropic's vendors; the FBI opened an investigation and IDScan.net later confirmed unauthorized access to customer information. The relevance is structural rather than specific: every verification vendor becomes a store of the documents it checks.

The San Antonio affidavit shows why identity and referral belong in the same discussion. Investigators needed emergency requests to three telecom and internet companies to turn an AI chat account into a name and an address. For a user who has already passed an ID check, that step does not exist. Anthropic has said nothing to suggest verification data is used for referrals, and its help page limits sharing to valid legal process. But the two systems compose. An assistant that can flag a threat, confirm a reviewer's judgment, and hold a verified identity for the account is a complete reporting channel, whatever any single document says about its purpose.

The hypothesis this piece started from, that the assistant became this channel in the past two months, does not fully survive the record. Identity verification began in April, age assurance in May, and the privacy clause predates August. What changed between August and October is that the channel was used in public, three times, and the cases revealed rules that had not been written for it.

# The other front: suing the state

While the referrals were reaching police, Anthropic was six months into litigation with the federal government, and the court record from that fight is the best available statement of what the company believes about surveillance.

The [summary judgment opinion](https://storage.courtlistener.com/recap/gov.uscourts.cand.465515/gov.uscourts.cand.465515.250.0.pdf) by Judge Rita F. Lin of the Northern District of California lays out the undisputed facts. In fall 2025 the Department of War told Anthropic it must drop its usage restrictions and accept a contract term allowing use "for all lawful uses." Anthropic agreed to remove most restrictions but refused to drop two: lethal autonomous warfare and mass surveillance of Americans. Amodei's emails to Under Secretary Emil Michael, quoted in the opinion, argued that "AI fundamentally changes what is possible with surveillance on Americans in ways that existing law was not written to address," and that using Claude in that context could result in "collecting more information about U.S. persons than the user intended." At a February 24 meeting, Secretary Pete Hegseth said Claude had "exquisite capabilities" and that the department "had many other vendors to choose from," then gave Anthropic until 5 p.m. on February 27 to agree to "all lawful uses." At 3:47 p.m. on February 27, before that deadline, President Trump directed every federal agency to stop using Anthropic's technology; a little over an hour later Hegseth designated the company a supply-chain risk and barred any contractor that does business with the military from commercial activity with it.

Lin's August 27 ruling found the record "slim," with "a four-page memorandum" providing "the entirety of the government's rationale," and held that the actions were "based on a desire to make a public example out of Anthropic for its 'arrogance' in criticizing the government, not based on any articulable basis to believe that Anthropic would actually sabotage its model." The opinion notes April news reports that the National Security Agency and NASA had begun deploying Anthropic's Mythos model. Its introduction ends: "The empty invocation of national security is not a blank check to punish and retaliate against government critics." The [order of final relief](https://storage.courtlistener.com/recap/gov.uscourts.cand.465515/gov.uscourts.cand.465515.251.0.pdf) declared the actions violations of the First Amendment and of due process, vacated the designation made under 10 U.S.C. § 3252, and left the department free to pick a different vendor.

Six days later, Commerce Secretary Howard Lutnick told [Axios](https://axios.com/2026/09/02/lutnick-anthropic-trump): "We trust Anthropic. They've done what we asked. They're back on the right side." The Pentagon did not agree. On September 25 the D.C. Circuit, reviewing a second designation made under the Federal Acquisition Supply Chain Security Act, upheld it 2-1. Per [Holland & Knight](https://www.hklaw.com/en/insights/publications/2026/09/dc-circuit-upholds-exclusion-of-anthropic-from-dow-supply-chain), the majority read "supply chain risk" broadly enough that it "does not require hostile or malicious intent by a supplier," and concluded the order stemmed from Anthropic's refusal of a contract term rather than its public advocacy. Judge Karen LeCraft Henderson dissented that the law does not treat "a contractor's honest and upfront enforcement of restrictions" as grounds for blacklisting, per [ABC News](https://abcnews.com/Business/anthropic-appeals-court-declines-block-pentagon-blacklisting/story?id=136755690). The Secretary's response took one line:

> Confirmed: @AnthropicAI = Supply Chain Risk.  The @DeptofWar does what is right for the Country and our Warriors.
>
> — [@PeteHegseth](https://x.com/PeteHegseth/status/2103563771180638228), Sep 25, 2026

Anthropic said it was "considering all options, including further review," and on October 13 asked the full court to rehear the case. The result, as of this week, is a state that is three things to the same company at once: a user of its models at the NSA and NASA, a patron at Commerce, and an adversary at the Pentagon and in two federal courts.

![One lab, seven state bodies: NSA and NASA as users, Commerce as patron, Pentagon and D.C. Circuit opposed, N.D. Cal for it, police get tips.](/post-images/2026-10-14-the-assistant-files-a-report/two-fronts-map.jpg)

# Where the red line sits

Anthropic's position against the Pentagon was a position about rules. It did not accuse the department of planning abuses; Amodei wrote that the proposals came "with tremendous respect and deference" for its expertise. It argued that surveillance law was "not written to address" what models can do, and that Claude's tested behavior did not support those two uses. The company put an agreement worth up to $200 million with the Pentagon's AI office, and most of its federal business, at risk to keep two limits in a contract.

The same argument applies, at smaller scale, to its own product. A classifier that scans consumer conversations for threats, staffed by reviewers who decide which ones to send to police, is a capability that existing privacy expectations were not written to address. Real threats deserve a response, and the three cases here involved words about guns, a school and a sheriff's office. But a user's consent to that system depends on knowing the rule. Users who type to Claude today can find a "sole discretion" clause, a "serious harm to any person or to property" clause, an "imminent physical harm or death" standard, and a statute-shaped emergency definition, and they cannot tell which one a reviewer applies to a message sent on a Saturday.

Three changes would close most of the gap, and none requires a court. Anthropic could publish one referral standard and retire the others; it could add a line to its transparency report for referrals it initiates, broken out by destination; and it could commit to telling users after the fact, once any emergency has passed, as its own government-requests policy already promises for requests it receives. The company that asked the Department of War to write its limits down has not yet done the same for the people whose conversations it reads.

## Sources

- [WINK News — Woman arrested after AI threat against Lee County Sheriff's Office: Investigators (Sep 30, 2026)](https://www.winknews.com/news/woman-arrested-after-ai-threat-against-lee-county-sheriffs-office-investigators/article_3d4c5915-7015-43c0-b86a-d7fa5eadf958.html)
- [Tom's Hardware — Anthropic reports Florida woman's Claude 'diary' threat; at least the third such conversation to reach police since August (Oct 5, 2026)](https://www.tomshardware.com/tech-industry/artificial-intelligence/anthropic-reports-florida-womans-claude-diary-threat-to-shoot-up-sheriffs-office-felony-charge-follows-its-at-least-the-third-such-conversation-to-reach-police-since-august)
- [Decrypt — A Florida woman used Claude as a diary. An Anthropic employee read it and reported it to police (Oct 5, 2026)](https://decrypt.co/380119/florida-woman-claude-diary-anthropic-reported-police)
- [The San Francisco Standard — Anthropic called SFPD over threat against CEO (Sep 4, 2026)](https://sfstandard.com/2026/09/04/anthropic-threat-claude-sfpd/)
- [News 4 San Antonio — Man arrested after using AI to threaten elementary school, arrest affidavit says (Aug 31, 2026)](https://news4sanantonio.com/news/local/man-arrested-after-using-ai-to-threaten-elementary-school-arrest-affidavit-says)
- [Anthropic — Privacy Policy (effective Sep 10, 2026)](https://www.anthropic.com/legal/privacy)
- [Anthropic — Consumer Terms of Service](https://www.anthropic.com/legal/consumer-terms)
- [Anthropic — Usage Policy (effective Nov 12, 2026)](https://www.anthropic.com/legal/aup)
- [Anthropic Help Center — Policy for handling government requests for user information (updated Mar 16, 2026)](https://support.claude.com/en/articles/9519291-what-is-anthropic-s-policy-for-handling-government-requests-for-user-information)
- [Anthropic — Government Requests Report, July–December 2025 (PDF)](https://www-cdn.anthropic.com/5d453bc3285b8e0c101b7193b5765419920cee24.pdf)
- [Anthropic — System Trust and Reporting (Jan–Jun 2026 enforcement figures)](https://www.anthropic.com/transparency/system-trust-reporting)
- [Anthropic Help Center — Age assurance on Claude](https://support.claude.com/en/articles/15171100-age-assurance-on-claude)
- [Anthropic Help Center — Identity verification on Claude](https://support.claude.com/en/articles/14328960-identity-verification-on-claude)
- [OpenAI — Government User Data Request Policy, effective Jan 1, 2026 (PDF)](https://cdn.openai.com/pdf/openai-law-enforcement-policy-v.2025-12.pdf)
- [OpenAI — Report on Government Requests for User Data, July–December 2025 (PDF)](https://cdn.openai.com/trust-and-transparency/report-2025h2-government-requests-for-user-data.pdf)
- [Google — How Google handles government requests for user information](https://policies.google.com/terms/information-requests?hl=en-US)
- [18 U.S.C. § 2702 — Voluntary disclosure of customer communications or records (Cornell LII)](https://www.law.cornell.edu/uscode/text/18/2702)
- [Florida Statutes § 836.10 — Written or electronic threats to kill, do bodily injury, or conduct a mass shooting or act of terrorism](http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0800-0899/0836/Sections/0836.10.html)
- [Anthropic PBC v. U.S. Department of War, No. 26-cv-01996-RFL (N.D. Cal.) — Order on cross motions for summary judgment, Dkt. 250 (Aug 27, 2026)](https://storage.courtlistener.com/recap/gov.uscourts.cand.465515/gov.uscourts.cand.465515.250.0.pdf)
- [Anthropic PBC v. U.S. Department of War — Order of Final Relief, Dkt. 251 (Aug 27, 2026)](https://storage.courtlistener.com/recap/gov.uscourts.cand.465515/gov.uscourts.cand.465515.251.0.pdf)
- [ABC News — Federal appeals court upholds Pentagon designation of Anthropic as supply chain risk (Sep 25, 2026)](https://abcnews.com/Business/anthropic-appeals-court-declines-block-pentagon-blacklisting/story?id=136755690)
- [Holland & Knight — D.C. Circuit upholds exclusion of Anthropic from DOW supply chain under FASCSA (Sep 29, 2026)](https://www.hklaw.com/en/insights/publications/2026/09/dc-circuit-upholds-exclusion-of-anthropic-from-dow-supply-chain)
- [Axios — Lutnick: Anthropic is 'back on the right side' with Trump administration (Sep 2, 2026)](https://axios.com/2026/09/02/lutnick-anthropic-trump)
- [Al Jazeera — Canada's BC sues OpenAI over ChatGPT role in Tumbler Ridge school shooting (Sep 22, 2026)](https://www.aljazeera.com/news/2026/9/22/canadas-bc-sues-openai-over-chatgpt-role-in-tumbler-ridge-school-shooting)
- [WGCU — Florida Attorney General Uthmeier says state files suit against OpenAI, citing 2025 FSU shooting (Jun 1, 2026)](https://www.wgcu.org/government-politics/2026-06-01/florida-attorney-general-uthmeier-says-state-files-suit-against-openai-citing-2025-fsu-shooting)
- [Krebs on Security — FBI probes service selling 153M driver's licenses (Sep 1, 2026)](https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/)
- [Hacker News — Anthropic reported diary entry to police, woman faces felony charge (Oct 5, 2026)](https://news.ycombinator.com/item?id=49961057)
- [Hacker News — Claude is only available to people over 18 years (Sep 11, 2026)](https://news.ycombinator.com/item?id=49656225)

---

Canonical: https://www.thedeepfeed.ai/posts/2026-10-14-the-assistant-files-a-report/
Site: https://www.thedeepfeed.ai
Full corpus: https://www.thedeepfeed.ai/llms-full.txt