Carli Michelle Heller told deputies that she used Claude like a diary. According to Decrypt, citing local WINK News and the arrest report, her September 26 conversation said she would “shoot up” the Lee County Sheriff’s Office, and another conversation said she had obtained a new gun by the next day. Anthropic’s systems flagged the exchange, a human team reviewed it, and the company reported it to police. Deputies detained Heller without incident. She now faces a November court date on a second degree felony charge. She has not been convicted.
That referral may have prevented violence. It also exposed a power most Claude users will discover only if they read the legal pages: Anthropic monitors chats for harmful content, sends flagged conversations to human reviewers, and may give those conversations to police without waiting for a government request. TechSpot’s account of the arrest says a reviewer decided Heller’s words were a credible threat. Anthropic has not published the criteria that turned that decision into a police report.
The contract gives Anthropic the whole decision
Anthropic’s consumer terms reserve the right, “at our sole discretion,” to report a user’s inputs, outputs, or actions to law enforcement. The clause does not say imminent threat, serious injury, or emergency. It simply reserves the power.
Other Anthropic pages describe narrower rules, but they do not line up cleanly. The company’s privacy policy permits disclosure when Anthropic has a good faith belief that sharing is reasonably necessary to prevent serious harm to a person or property, address illegal activity, enforce its terms, or protect Anthropic and others. Its government request policy says the emergency exception applies when imminent physical harm or death may occur and immediate disclosure may avert it.
A user trying to learn the rule gets three answers: sole discretion in the contract, serious harm and illegal activity in the privacy policy, and imminent physical harm or death in the government request policy. Anthropic’s public description of its safety system adds that detection models flag potentially harmful content and can produce false positives or false negatives. It says nothing about the threshold a reviewer must meet before involving police.
Anthropic also reserves another use for flagged chats. Its terms say conversations sent for safety review may be used for model training even when the user has opted out. A person can refuse ordinary training and still have a flagged conversation used to improve Anthropic’s harmful content detection. Heller called Claude a diary. Anthropic treated the entry as a potential threat, sent it to police, and may use it to train safety systems.
Federal law lets the company make the call
A warrant was not legally required before Anthropic made a voluntary emergency disclosure. Section 2702 of the Stored Communications Act expressly allows a provider to disclose communications and customer records when it believes in good faith that an emergency involving danger of death or serious physical injury requires disclosure without delay.
Congress handed the provider the first decision. Section 2702 also requires the attorney general to report certain emergency disclosures to congressional judiciary committees, including summaries of cases the Justice Department closed without charges. That accounting covers disclosures received by the Justice Department. It does not create a public ledger of proactive referrals made to state and local police, including a referral to a county sheriff like this one.
Florida’s charge is also more specific than a generic prosecution for disturbing thoughts. Section 836.10 criminalizes sending or transmitting a written or electronic threat to kill, injure, or conduct a mass shooting when another person may view it. Whether prosecutors can prove every element against Heller belongs in court. The company’s decision to expose her chat happened before that process and remains almost entirely hidden from public review.
Hidden standards produce irreconcilable outcomes
OpenAI faced the opposite failure in British Columbia. Its systems flagged Jesse Van Rootselaar’s conversations about gun violence months before she killed eight people and died by suicide in Tumbler Ridge. The province’s lawsuit alleges that safety staff recommended contacting police and company leaders refused. OpenAI said the conversations did not meet its internal criteria for a law enforcement referral.
Anthropic made another call last month. The San Francisco Standard reported that Claude flagged a user who allegedly wrote that he had bought an AR-15 and had CEO Dario Amodei “in his sights.” Anthropic contacted San Francisco police. The user said he had been joking, and he had not been arrested or charged when the story ran. The Anthropic employee who met officers said he was not immediately concerned for safety and refused to show them the messages because of company policy. Anthropic would not say whether threats against its own employees receive different treatment.
The facts in these cases are not identical, and different outcomes do not prove that every judgment was wrong. They do show why secret criteria are unacceptable. One company declined to report a user who later murdered eight people. Anthropic reported an alleged threat against its own chief executive that had produced no charge by publication. It then reported Heller, whose explicit words and reported gun acquisition present a much stronger case for intervention.
Maybe context justifies every difference. Because the criteria stay private, no one outside the companies can test that explanation. We see the arrest, the massacre, or the police visit after each review is over. We do not see how many harmless conversations were escalated, how often reviewers disagreed, what information the company disclosed, or whether pressure from lawsuits has pushed the threshold downward.
Emergency power needs a public record
Anthropic already knows how to publish safety numbers. Its transparency hub reports 11.4 million banned accounts and 15,079 reports to the National Center for Missing and Exploited Children during the first half of 2026. The legal requests section lists government request reports only through 2025 and gives no visible count for proactive violence referrals.
Anthropic can fix that without identifying a single user. It should publish the number of proactive referrals, the jurisdictions that received them, the categories of danger involved, and the outcomes when known. It should publish the written threshold reviewers apply. Each case should record what data was handed over, with notice to the user once doing so no longer creates a safety risk or threatens an investigation. An independent auditor should be able to inspect cases that ended without charges.
Congress should close the larger gap by extending Section 2702’s reporting rules beyond disclosures received by the Justice Department. Emergency reports to every level of government should leave an auditable trail. Police should still use proper legal process when they seek more than the information required to address the emergency.
Heller’s alleged words were serious. Anthropic’s power is serious too. A company that reviews user conversations, trains on some of the flagged material, and refers users to police cannot answer scrutiny with three competing policy formulations and a promise that its safeguards worked. If Anthropic wants the public to trust that judgment, it needs to publish the rules, the numbers, and the mistakes.