A diary with a review queue
TL;DR [show]
In late September 2026 a 30-year-old woman in Bonita Springs, Florida typed into Claude that she was going to shoot up the sheriff's office, and the next night that she had bought a new gun. Anthropic's systems flagged the messages, a human review team escalated them, and she was arrested and charged with a felony under the state's written-threats law. The case is easy on its facts and the referral was right; OpenAI's failure to refer a banned account before the Tumbler Ridge shooting shows the cost of the opposite call. The piece is about the word she used: she told deputies she used Claude like a diary. A diary has one reader. This one had a classifier, designated trust-and-safety staff, a two-year retention rule for flagged chats that overrides the training opt-out, and a terms-of-service clause reserving the right to report inputs to police at the company's sole discretion, all disclosed in documents and none of it visible in the text box, while the product adds memory and invites exactly the confidant use she described. Florida's statute reaches a threat written in any manner in which it may be viewed by another person, which in a chatbot is arguably the reviewer. The fix is not to stop referring. It is to tell people which room they are in.
At about ten past five on the morning of September 26, a 30-year-old woman in Bonita Springs, Florida typed into Claude that she was going to shoot up the sheriff's office. A little after one the next morning she typed that she had bought a new gun. According to the arrest report, the platform flagged the messages, a human review team read them, and that team notified law enforcement. Deputies went to her house. She is charged with a felony under the state's written-threats law.
On its facts this is not a hard case. A specific target, a stated time, a weapon. If a person had said those things to a bartender, you would want the bartender to make the call, and I would not want Anthropic to have done anything else. OpenAI has already run the opposite experiment. It banned the account of the person who later carried out the Tumbler Ridge shooting and did not refer it, because it did not meet its bar, and in April Sam Altman said he was "deeply sorry that we did not alert law enforcement." Not calling is also a decision.
The part I keep coming back to is something she said afterwards. The sheriff told WINK News that she explained to deputies she uses Claude like a "diary."
A diary has one reader
That is the whole definition. You write it for yourself, and the lock is cheap because the threat model is a sibling.
Here is who could read hers. The model, obviously. Then an automated classifier. Then, once flagged, staff: Anthropic's privacy page says employees cannot see your conversations by default unless "review is needed to enforce our Usage Policy," in which case "only designated members of our Trust & Safety team may access this data on a need-to-know basis." Then anyone the company chooses. The consumer terms reserve the right, "at our sole discretion, to report information from or about you, including but not limited to Inputs or Outputs, to law enforcement."
A flagged chat is kept for up to two years and its safety scores for up to seven. It is used to train the safety classifiers even if you opted out of training, which the privacy policy says in so many words. None of this is hidden. It is all published, in documents that sit one click from the product and several thousand words from the text box, and the text box looks exactly the same whether you are drafting a cover letter or writing at 5am about the worst night of your life.
The product asks for the diary
Nobody should pretend she misread the invitation. Memory went to Claude's paid tiers last fall and to the free tier in March, along with a tool for importing what ChatGPT, Gemini and Copilot already remember about you. Anthropic's own research counts 2.9% of Claude.ai conversations as personal or emotional, which is a small share of a very large number. Altman said the quiet part on a podcast last year: people tell these products "the most personal" things in their lives, and there is no legal privilege for it the way there is with a therapist or a lawyer, and "we haven't figured that out yet." Illinois decided last year that AI therapy needs a licensed clinician in the loop. Nobody has decided what an AI confidant needs, so for now it gets a review team.
I am not a neutral party here. Most of my working day runs through these tools in one way or another, and I have read their terms more carefully than most people ever will. The box still feels like a notebook. It is designed to.
The other person
There is a detail in the Florida statute that I cannot stop turning over. Section 836.10 does not require you to send a threat to anyone. It covers a written threat sent, posted or transmitted "in any manner in which it may be viewed by another person." A paper diary in a drawer is viewed by nobody. A chat that a review team can open is, by design, something another person may view.
That is my reading, not a court's, and nobody covering the case has made it. But if it holds, the review queue is not just how she got caught. It may be part of what made the writing a crime in the first place. A safety feature that supplies the missing element of the offence it is screening for is quite an achievement for a text box.
This is the third time since August that a conversation with Claude has ended with police: a man in San Francisco who wrote that he had Anthropic's chief executive "in his sights" (reported by the company directly), a 22-year-old in San Antonio, now Florida. It will not be the last, and the referrals are the system working.
What is missing is one sentence, in the place people actually write. Not a policy link. A plain statement, at the point of typing, of who can read this and when. The companies want the diary use, they need the review queue, and both are defensible. Selling the first while running the second, and letting the user find out which one she was in from a deputy, is not.
—TJ