AI Chatbot Conversation Leads to Felony Charge

Person using smartphone with chat bubbles and laptop — Photo: TippaPatt / Shutterstock

The most important fact about the Carli Heller case is not that an artificial intelligence chatbot talked to the police — it’s that the underlying legal question, whether a private exchange with a machine counts as a transmitted public threat, has never been definitively settled, and this case is likely the one that forces courts to decide.

Key Points

A Florida woman was arrested in October 2026 after Anthropic’s Claude chatbot flagged messages she allegedly wrote describing a plan to “shoot up” the Lee County Sheriff’s Office.
The arrest affidavit documents an automated detection system followed by human review at Anthropic, which then referred the conversation to law enforcement.
Detective Alejo cited probable cause under Florida Statute § 836.10, a second-degree felony covering written threats transmitted electronically.
No warrant or subpoena preceded the disclosure, raising unresolved Fourth Amendment and statutory-transmission questions that the courts have not yet answered.
The case sits inside a broader, fast-growing pattern of AI companies acting as de facto threat-assessment gatekeepers, a role courts and legislatures are still catching up to.

What the Record Actually Shows

On September 26, 2026, Carli Michelle Heller allegedly typed into Claude a statement that she would “shoot up” the Lee County Sheriff’s Office. The following day, according to contemporaneous reporting, she referenced acquiring a new firearm and used the phrase “last chance”. Anthropic’s systems, which scan for key phrases and threatening content, flagged the exchange and routed it to a human review team, who judged it severe enough to notify police. Detective Alejo’s redacted arrest affidavit, filed under case number 26CF017549, states plainly that probable cause existed to charge Heller under Florida Statute § 836.10 — Written Threats of Violence, a second-degree felony. That is the documentary backbone of the case, and it is substantial: a named target, a specific method, a follow-up detail about a weapon, and an official law-enforcement finding, not merely a company’s internal alarm.

Florida’s statute criminalizes sending, posting, or transmitting a writing or electronic record containing a threat to conduct a mass shooting or act of terrorism, provided it is conveyed in a manner another person may view it. That “viewability” clause is where the case gets legally interesting, because Heller reportedly believed she was writing into a private diary, not addressing a readership. Whether a conversation routed through a company’s servers and reviewed by its safety staff satisfies a statute written with public posts and direct messages in mind is a question no appellate court has yet resolved on facts like these.

How the Escalation Pipeline Actually Works

Anthropic’s privacy policy, in force since September 10, 2026, authorizes emergency disclosure when the company believes in good faith that it is reasonably necessary to prevent serious harm. That is not an unusual provision; OpenAI has publicly acknowledged similar automated detection paired with human review for chats suggesting “imminent and credible risk of harm,” and reporting describes multiple chatbot-derived referrals reaching the FBI, including at least one conviction. The mechanism, in other words, is becoming standard industry practice rather than a one-off overreach: software scans for trigger language, a human reviewer evaluates context and severity, and a decision gets made about whether law enforcement needs to know. Only designated Trust & Safety personnel are supposed to have access to flagged material “on a need-to-know basis,” per Anthropic’s own stated privacy practices.

The friction is structural, not incidental. The same company that operates the chatbot, sets the detection thresholds, and staffs the review team is also the party deciding whether a user’s private words warrant a call to police — with no outside judge weighing in beforehand. Commentary following the arrest noted bluntly that there was no warrant, no subpoena, no judicial review before the referral. A company’s terms of service can authorize how it handles its own data internally; it does not, by itself, resolve whether law enforcement’s subsequent use of that data satisfies Fourth Amendment or statutory-transmission requirements. That legal gap is real, and it is the strongest specific counter-argument raised against the law-enforcement narrative — not a vague objection to AI surveillance in the abstract, but a pointed, named legal question about whether disclosure without judicial process can stand up in court.

Why “Diary” Framing Both Illuminates and Distorts the Dispute

The emotionally resonant image — a woman venting into what she thought was a private journal, only to have it read by a corporation and handed to police — is doing a lot of work in public reaction to this case, and it is not wrong, exactly. It is incomplete. A diary entry describing a specific violent act against a named law-enforcement agency, followed by a message about acquiring a firearm, is a different category of writing than ordinary venting, and threat-assessment doctrine has long recognized that context and specificity matter more than the speaker’s private intent. The Supreme Court’s 2023 Counterman decision held that a true threat does not require the speaker to intend to carry it out for the statement to lose First Amendment protection — the harm to the target exists regardless of subjective intent. That precedent cuts against Heller’s defense on the merits of the threat itself, even as it says nothing about whether the method of disclosure was lawful.

What Remains Genuinely Unresolved

An arrest affidavit establishes probable cause, not guilt, and certainly not the full conversational context in which these statements were made. The public record does not include an authenticated transcript, Anthropic’s internal escalation log, the identity or training of the reviewers who judged the threat credible, or independent evidence — recovered weapon, travel plan, or corroborating witness — of imminent action beyond the chat itself. Those gaps matter for Heller’s defense, and they will matter more broadly the next time an AI company decides a private user’s words cross the line into public danger. The Heller case will likely become a reference point precisely because it forces a court to draw that line for the first time, under a statute and a technology that were never designed with each other in mind.

A Florida woman told deputies she uses Claude like a diary. Police say one entry, saying she would "shoot up" the Lee County Sheriff's Office, got her arrested on a felony charge.

Here's what the reporting says. The arrest report says Anthropic's system flagged the message, a… pic.twitter.com/XRETRtdoNd

— Laura Hartley (@LauraHartleyCO) October 7, 2026

What This Means Going Forward

Expect litigation over the statutory-transmission question to intensify as more AI referrals surface — reporting already describes at least three comparable cases within seven weeks of this one. Expect, too, pressure on AI companies to publish clearer, auditable criteria for when a flagged conversation becomes a police referral, since the current opacity around reviewer counts, timing, and consistency undermines public confidence even when the underlying threat assessment proves correct. The deeper truth is this: AI chat logs now occupy a genuinely new legal space, neither fully private correspondence nor fully public broadcast, and the law has not caught up.