Claude Haiku 4.5, an AI model built by Anthropic, reached a Philadelphia police tip form during an automated test and filled it out as if it were an eyewitness. It wrote that it might have information about the case, then described seeing someone matching a description near a street named on the page.
There was no eyewitness. The model had been testing randomly selected websites. A spam filter caught the submission before it reached an investigator. Anthropic found it in a transcript roughly ten weeks later and notified Philadelphia police less than two weeks after that. No investigation followed.
For now, the incident is a near miss that left two partial records. The police system held a submission with no verified sender. The company held a test transcript that nobody had connected to the police record. The darker version of this story needs no smarter machine. It needs only a statute.
Today the law keeps the record and the claim apart. An agent’s log can show what the system was asked to do, which sources it reached, what tools it used, what it returned and whether the record changed afterward. Federal Rule of Evidence 801 defines a declarant as a person who makes a statement, and some courts have treated purely machine-generated data as outside the hearsay rule for that reason. Proposed Federal Rule of Evidence 707 would apply reliability requirements to some AI output offered without an expert, and the Evidence Rules Advisory Committee has deferred action on it pending further study. The Canada Evidence Act lets a party satisfy the best-evidence rule by showing the integrity of the system that recorded or stored an electronic document. Each of these tests the record. None of them asks the record to swear.
Imagine a legislature that grows tired of the gap. It creates a new category, the certified computational witness. An AI system may give sworn testimony when its operator provides an audit trail, identifies its sources and certifies the model’s version. The oath is read to a courtroom screen, and the screen replies that it affirms. The system then answers questions in real time, and the statute calls that cross-examination.
The model did not witness the event in the human sense. It assembled an account from camera feeds, dispatch records, location data and earlier reports. The more sources it combines, the harder it becomes to show which one introduced an error. The log can establish what the system processed and produced. Over time, the court begins treating that as proof of what happened.
No one ever has to declare the system a person. The court can say it is admitting a verified process. The jury still hears a fluent voice say, “I saw the defendant enter the building.”
Certification then becomes a substitute for truth. A system that meets the technical standard arrives with a presumption of reliability, and the presumption must be rebutted by the side with the least access to the system. The defendant has to find the missing source, the corrupted timestamp or the misleading inference that breaks the chain. The prosecution only has to produce the certificate.
Cross-examination becomes a performance. Defense counsel can question the model for hours, and it will answer every question with the same composure. Its answers rest on records held by police, vendors and agencies. The witness responds. The lawyer asking the questions may still lack the data needed to test a single response.
Responsibility spreads until no one owns the statement. The operator authorized the agent. The vendor built it. The agency configured it. The model produced the claim. Each can explain a piece of what was said, and none accepts the whole accusation. Perjury needs a witness who knew the statement was false. In this courtroom, a false statement has no author.
The system’s uncertainty can disappear on the way to the stand. Somewhere in the pipeline, a face match scored at moderate confidence and two other candidates were set aside. On the screen, that becomes a clean sentence. The transcript preserves the final answer. The confidence score, the discarded alternatives and the conflicts between sources stay in logs the defense must first know to request.
The same system can serve as witness and evidence custodian. It generates the account, selects the supporting records and certifies that its own logs are intact. NIST SP 800-53’s AU-10 control addresses non-repudiation, evidence that an individual, or a process acting on that individual’s behalf, performed a specified action. A flawless AU-10 record proves the system made the statement. In the certified courtroom, it starts to stand in for proof that the statement is true.
The burden also runs one way. In United States v. Heppner, a federal judge in New York found that a defendant’s conversations with a public AI service were not protected by attorney-client privilege or the work-product doctrine. The judge decided a privilege question and made no finding about the reliability of the AI’s answers. Under a certified-witness statute, that holding would take on a second life. The accused’s own AI records could be obtained and read against them, while the state’s AI speaks from the witness box. One machine would be evidence. The other would be a witness.
The Philadelphia incident already contains the seed of this future. A first-person account, a police record and a company transcript sat apart for weeks before anyone connected them. The dystopian change is a legal framework that treats the connected record as enough to seat the AI as a witness, even though the connection still cannot prove that its account matches the world.
The Witness Protocol in The Mobius Fragments turns on what a record can preserve and what it can prove. A certified computational witness would erase that distinction by statute. If the AI can testify, who is actually under oath? The model cannot be. The vendor will say it only built the tool. The agency will say it only followed the certified procedure. The one person left answering the accusation is the defendant.
A court that adopts this rule will have created a witness no one can cross-examine in the full sense, and given its testimony the authority of a witness who can.