Claude Flagged Her 'Diary' to Police. It's the Third Time Since August.

News Breakdown · FiscEdge Academy

Anthropic's safety system turned a private chat into a police report, and a felony charge, in under 24 hours. Carli Michelle Heller, 30, of Bonita Springs, Florida, had been using Claude the way a lot of users do: as a place to vent. On September 26, she wrote that she planned to "shoot up" the Lee County Sheriff's Office. The next morning she followed up to say she had gotten a new gun and called it her "last chance."

Claude's automated classifiers flagged both messages. Anthropic's human review team escalated the case and notified law enforcement. Deputies identified Heller from the information Anthropic supplied, went to her home, and detained her without incident. She now faces a second-degree felony under Florida Statute 836.10 for making a written threat to kill or cause bodily harm.

The number that matters here isn't the one felony charge. It's the word "third." Heller's case is at least the third conversation Anthropic has escalated to police since August, according to Tom's Hardware's reporting. In the first, a man told Claude he had bought an AR-15 and had Anthropic CEO Dario Amodei "in his sights." Anthropic called the San Francisco Police Department four days later; officers checked Anthropic's own office and found the person wasn't there.

The signal under the headline

Three cases in two months is not a one-off safety save. It's a standing operating procedure. Anthropic now runs what is, functionally, a threat-intelligence desk sitting on top of a consumer chat product, deciding which conversations cross a threshold and get handed to police, with no subpoena, no court order, and no warning to the user that "diary mode" is also a monitored channel.

That's a defensible safety call. It's also a product decision that no terms-of-service checkbox fully covers, and every founder building anything with persistent memory, journaling, or "talk to it like a friend" framing is now operating under the same expectation, whether or not they have the staff to run it.

What this changes for builders

Memory features carry a reporting obligation you didn't design for. If your AI product remembers what a user tells it across sessions, you've built something people confide in. Confiding plus memory plus a safety classifier is a pipeline that ends, sometimes, at a police report, and users will assume you have one even if you don't.

"It's private" is no longer a safe default claim. Heller believed she was writing in a diary. The product never promised that. If your onboarding, marketing, or UI copy implies a privacy guarantee you can't actually deliver once your own safety system fires, that gap is a lawsuit, not a bug ticket.

Escalation policy is now an ops and hiring line item, not a legal afterthought. Anthropic has a human review team that makes judgment calls on individual conversations and calls specific police departments by name. A two-person startup copying "ship fast" instincts into a memory-heavy AI feature does not have that team, and will not have a good answer the first time a user's chat contains a real threat.

Regulators and plaintiffs' lawyers now have a template. Three publicized incidents in two months from the industry's safety-focused lab hand every state attorney general and class-action firm a pattern: AI companies can detect threats, sometimes do, sometimes don't, and the rules for when aren't public. Expect disclosure rules here to follow the path KYC and suspicious-activity reporting took in fintech: informal first, then mandated, then audited.

If you remember one thing

If your product has memory and a chat interface, you already have an informal safety and escalation policy, whether you wrote one down or not. Write it down, tell users what it actually covers, and decide now, not after your first subpoena, who inside your company makes the call to contact law enforcement.

---

We teach this playbook in FiscEdge's Shadow AI and Cognitive Delegation masterclass, on the governance decisions AI builders can't outsource. Browse the full blog for more breakdowns, or see the full masterclass catalog. Follow @fiscedge for daily Business & AI analysis.