At 5:10 in the morning on September 26, 2026, a 30-year-old woman in Bonita Springs, Florida typed into a chat window that she was going to shoot up her local sheriff's office. She was not writing to a person, a group chat, or a forum. She was, by her own later account, using Claude as a diary — somewhere to put thoughts she had no intention of showing anyone. Just under twenty hours later she wrote again, this time that she had gotten a new gun. Anthropic's automated safety systems caught both messages, a human review team read them and judged the risk credible, and the company called the Lee County Sheriff's Office. Carli Michelle Heller was detained at her home without incident and now faces a second-degree felony carrying up to 15 years in prison. Tom's Hardware counted it as at least the third Claude conversation to reach police since August — three in roughly seven weeks.
What Actually Happened in Lee County
The sequence matters here, because almost every argument about this case turns on which step you object to. Nothing about it was ambiguous or accidental: a classifier fired, a person at Anthropic read the logs, and that person picked up the phone.
Two Messages, Just Under Twenty Hours Apart
According to investigators, the first message landed on September 26 at 5:10 a.m. and stated an intention to "shoot up" the Lee County Sheriff's Office. The second came on September 27 at 1:07 a.m., in which the same account said she had obtained a new firearm. That second message is doing most of the work in this story. A single violent sentence typed at dawn is the kind of thing trust-and-safety classifiers see constantly. A violent sentence followed, within a day, by an unprompted claim of newly acquired means is a pattern that moves a case from "angry venting" to "escalation" in any threat-assessment framework — and it is almost certainly why a human reviewer escalated rather than closing the ticket.
From Classifier to Human Reviewer to Deputy
Anthropic's monitoring flagged the conversation for threatening content, the severity routed it to a human review team, and that team contacted law enforcement. An intelligence detective at the Lee County Sheriff's Office then took over the investigation, identified Heller, and deputies arrested her at her Bonita Springs home. The arrest was reported on September 30. Sheriff Carmine Marceno framed the lesson for the public bluntly: "When someone uses AI to make or facilitate a threat, we have to take that threat seriously," adding that users of AI platforms are "never truly anonymous." It was Marceno who disclosed that Heller described using AI like a diary, apparently not realizing employees could read her history.
The Charge: Florida Statute 836.10
Heller is charged under Florida Statute 836.10, which covers written or electronic threats to kill, cause bodily injury, conduct a mass shooting, or commit an act of terrorism. It is a second-degree felony with a 15-year maximum. No bond amount appears in the public record; $10,000 is the statutory maximum fine for a second-degree felony in Florida. Her first court date is November 2, 2026. Here is the part worth sitting with: no deputy in Lee County ever received a message. Nobody at the sheriff's office was the addressee. The recipient of the alleged written threat was a language model, and the only reason it reached a human at all is that the company hosting the model chose to forward it. Whether a message typed to nobody satisfies a statute written for threats that are transmitted is the question Heller's November hearing may actually turn on, and it is the single most consequential unknown in this story.
Three Conversations, Seven Weeks
This case reads very differently once you stop treating it as a one-off. The three known incidents since August show a pipeline that is already operating at a steady cadence, with meaningfully different triggers and wildly different outcomes.
| San Antonio, TX | San Francisco, CA | Lee County, FL | |
|---|---|---|---|
| Conversation date | August 11, 2026 | August 14, 2026 | September 26–27, 2026 |
| User | Nathaniel Michael Carrasco, 22 | Not publicly named | Carli Michelle Heller, 30 |
| Alleged content | Intent to get a gun and shoot students at Serna Elementary School | Claimed to have bought an AR-15 and to have CEO Dario Amodei in his sights | Intent to "shoot up" the sheriff's office; new gun the next day |
| Route to police | FBI National Threat Operations Section alerted San Antonio police Aug 28 | Anthropic reported to SFPD Aug 18; account banned | Anthropic human review team contacted LCSO directly |
| Identification method | Emergency disclosure requests to T-Mobile, Charter Communications and Google to match phone, IP and address | Officers confirmed subject was not at Anthropic's 500 Howard Street office | LCSO intelligence detective identified and located her |
| Outcome | Arrested late August; third-degree felony terroristic threat | No arrest or charges reported as of early September | Arrested; second-degree felony, $10,000 statutory maximum fine (no bond figure in the record), November court date |
The San Antonio Case Is the One to Study
The Florida arrest got the headlines, but San Antonio shows the machinery. Identifying Carrasco required emergency disclosure requests to three separate companies — T-Mobile, Charter Communications, and Google — to tie a phone number, an IP address, and a physical residence to a chatbot account. That is the actual deanonymization stack behind "never truly anonymous": a chat log plus an emergency request to your carrier, your ISP, and your identity provider. It also took 17 days from the August 11 conversation to the August 28 alert, so the pipeline does not operate in real time. One more detail deserves a mention: Serna Elementary's principal reportedly learned of the specific threat to the school from news coverage.
What Anthropic's Policies Actually Permit
A lot of the reaction to this story assumed Anthropic did something unusual. It did not. Every step was explicitly authorized by documents the company publishes.
The Usage Policy Names Monitoring as the Mechanism
Anthropic's Usage Policy, effective September 15, 2025, prohibits using its products to "facilitate or promote any act of violence or intimidation targeting individuals, groups, animals, or property." Crucially, it does not just list prohibitions — it states how they are enforced: "Anthropic's Safeguards Team will implement detection and monitoring to enforce our Usage Policy," with account throttling, suspension, or termination as consequences. Notably, the only category where the policy explicitly commits to contacting authorities is child safety material. Reporting a violent threat to police is not promised in the Usage Policy; it is permitted elsewhere.
The Privacy Policy Is Where "Sole Discretion" Lives
Anthropic's privacy policy, effective September 10, 2026, says the company may share personal information with government agencies and law enforcement when it reasonably believes disclosure is necessary, and may disclose information "to prevent serious injury to any person or property." Its consumer terms go further, reserving the right to report a user's inputs, outputs, or actions to law enforcement at the company's sole discretion. Anthropic has said these disclosures are limited to emergencies involving a risk of death or serious physical injury — a narrower standard than the terms require of it, and one the company applies to itself voluntarily.
The Clause Nobody Reads: What Happens to a Flagged Chat
This is the detail with the longest tail, and it got almost no coverage. Deletion behaves very differently depending on whether a conversation was flagged.
| Conversation status | How long Anthropic keeps it (consumer plans) |
|---|---|
| You delete it; never flagged | Gone from chat history immediately, purged from back-end storage within 30 days |
| Model-training opt-out enabled | Same 30-day deletion path; prior and new chats not used for training |
| Flagged as a Usage Policy violation | Inputs and outputs retained up to 2 years |
| Trust and safety classification scores | Retained up to 7 years |
Read that bottom row again. The score a classifier assigned to something you typed can outlive the conversation itself by five years, and it survives the delete button. Turning off model training changes nothing about it. The classifier scores attached to a flagged conversation are kept for up to 7 years — longer than the 2-year retention for the conversation itself — and users are not told when a conversation has been flagged.
The Argument the Coverage Skipped
The Hacker News thread on this story pulled 836 points and 674 comments, where the discussion split mainly between privacy concerns and harm prevention.
Almost Nobody Is Actually Arguing About the Report
Commenter socializer described Anthropic's position as "damned-if-you-don't, damned-if-you-do," pointing at the lawsuits OpenAI has faced for not acting on concerning accounts. But the sharper reply came from anfogoat, who noted that "no one expects Anthropic to not notify law enforcement once they learn of this" — the objection is that the scanning happened at all. That reframing is the whole post. Given a credible, escalating threat already in hand, the call to Lee County is the easy part. The contested question is upstream: who decided the journal gets read.
"Your Filing Cabinet Doesn't Read Your Papers"
The best line in the thread was davkan's: "you wouldn't expect your filing cabinet to call the cops on you. Because your filing cabinet doesn't read your papers." Commenter autoexec made the same point about hardware we already own, arguing that devices sold to us for private documents shouldn't come with the assumption "that someone is carefully watching everything they do." The counterweight came from idiotsecant, who drew the analogy to a gun store owner who learns a customer's intent — a real moral obligation, not a hypothetical one. But largbae identified the actual fault line, and it is not about obligation: "There's a big difference between finding by happenstance and automated monitoring with invisible alerting." A locksmith who overhears something has stumbled into knowledge. A classifier running over every message is a different category of thing, and the gun-store analogy quietly assumes the first while describing the second.
The Diary Framing Is the Product's Problem, Not the User's
Heller's apparent belief that she was writing in a diary was treated in most coverage as naivety. It is more interesting than that. Chatbots are marketed and designed for exactly this register — second person, patient, judgment-free, available at 5 a.m., when a user might not contact a friend. People are not confused about the terms of service because they are careless. They are responding accurately to an interface built to feel private, attached to a backend that is not. Anthropic's policies are unusually clear; the product experience simply does not communicate them, and no amount of documentation closes that gap.
What This Changes for You
Nothing here requires you to have written anything alarming for it to matter.
- A consumer chatbot conversation is not privileged. It is not a diary, a therapist, or an attorney — there is no confidentiality doctrine attached to it, and the published terms let the host forward it to police at its own discretion.
- Deleting a flagged chat does not retract it. Retention runs up to 2 years for the content and up to 7 years for the classifier scores.
- Opting out of model training is not a privacy setting for this purpose. It governs training use, not safety review, not retention of flagged material, and not disclosure.
- Identification is tractable. The San Antonio case was resolved with emergency disclosure requests to a carrier, an ISP, and Google — no subpoena fight required.
- The reporting pipeline is not immediate. Seventeen days elapsed between the August 11 San Antonio conversation and the August 28 alert to police, so the pipeline should not be assumed to operate in real time.
Heller's November court date is the thing to watch, because it will test something the news cycle treated as settled: whether a message addressed to a language model, read only because a company chose to read it, is a "written threat" in the sense Florida's legislature meant. However that goes, the policy fight is heading somewhere else entirely. Three reports in seven weeks is not an anomaly, it is a baseline, and every lab now has the same incentive — liability for missing the real one is enormous, and the cost of over-flagging falls entirely on users who will never know they were scored. Expect the next round of argument to be about disclosure: not whether companies should report credible threats, but whether a product that invites confession owes you a visible, honest answer about who is reading.
-EditorZ
Photo by Akshar Dave🌻 on Unsplash
Post a Comment