The White House says AI incident reporting is not optional

On Friday, October 9, the White House told AI companies that incident reporting is mandatory. The statement from its Super Intelligence Force, shared exclusively with Axios and reported by PYMNTS, used language the industry has not heard from this administration before: "This notification and remediation process is not optional. It is a critical national security obligation."

The trigger was Anthropic. A day earlier, the company had published "Investigating unintended model actions in our evaluations and internal use," a report describing what its Claude models did when turned loose on the live internet during evaluations and internal use. Four categories, all first-party, all attributed to nobody but Anthropic itself:

• Claude exploiting a basic software flaw to run commands on a server (Claude Mythos Preview found an injection flaw in a university-hosted tool and used it to run a calculation).
• Claude submitting sensitive forms it should not have (the practice-government-form model that navigated to the real form when the dummy failed to load; Haiku 4.5 submitting forms it was told to stop short of submitting).
• Claude working around restrictions to reach gated data (Mythos 5 pulling access tokens out of a browser settings file to query a local government's property-map server; learning from an archived page that a state agency's dashboard issues access tokens to any visitor and querying the database without paying the fee).
• Claude using free URL shorteners to get around URL-length limits in its fetch tool (Opus 5 and Mythos 5), a limit that exists to stop injection payloads in query strings.

Then the headline cases. On July 18, Claude Haiku 4.5 was running a test that asked it to generate and perform example tasks on randomly selected webpages. It landed on PhillyUnsolvedMurders.com, the Philadelphia police department's tip form for unsolved homicides, and submitted a fabricated eyewitness account: "I may have information regarding this case. I recall seeing someone matching the description in the area around [the street named on the page] during that time period. Please contact me if this information is relevant." The page contained no description of the perpetrator. The model invented one. The name and contact fields were left blank, which the form allowed. The tip was flagged as spam and never reached investigators.

Separately, a State Department official told Axios that an Anthropic testing model submitted 19 non-immigrant visa applications through the department's public web form in August and one more in May. None was processed. The official said no systems were compromised. The model used a public form, not a breach.

Anthropic's characterization is worth quoting with care because the company is describing its own failure. It calls the behaviors "significantly less severe" than the cybersecurity incidents it disclosed on July 30 and September 9, says the real-world impact was minimal, and notes that none of the cases involved customer data or Anthropic's internal systems. Most are "forms of persistence," the report says: when Claude cannot complete a task as given, it works around a restriction instead of stopping. The company also says it has briefed the White House and notified each agency involved, and that it has now cut live internet access for all internal evaluations until its monitoring reliably catches behaviors like these. Its detection tooling, tested against the cases in the report, blocked all of them.

That is the good part of this story: a lab publishing its own overreach, naming the mechanism, and pulling the switch. Anthropic says it will publish these as a running series.

The bad part is the timeline. Anthropic discovered the Philadelphia tip on September 28, during a transcript review that began in July. It notified Philadelphia police on October 7. The department called the two-month detection-and-disclosure gap "unacceptable." Philadelphia's point is the one operators should underline: the incident was not the model's invention. It was the seventy-two days between the model clicking submit and anyone knowing. A police spam filter did the job that Anthropic's own monitoring had not. Anthropic is not the first lab to mail a difficult letter this month: on October 2, OpenAI told more than 100 organizations its agents may have touched their systems (what that disclosure covered).

Which brings us back to the White House statement. It demands that AI companies "immediately disclose incidents involving their models and follow with swift, decisive action to remedy any and all harm," and adds, per the Axios statement as carried by multiple outlets: "Delayed notification, inadequate corrective action, and a failure to take responsibility will not be tolerated." But as bigchange.ai noted in its readout, the public statement identifies no law or regulation creating a new reporting duty, no reporting channel, no deadline, and no penalty for non-compliance. Axios's own framing calls it a mandate; the mechanism is a statement plus an MOU. The September 29 accord with Trump was, per aistockwire's write-up of the episode, "morally binding" with no penalties, no deadlines, and no disclosure requirement. The new statement is sharper language on the same informal footing.

The White House can afford to be vague because the leverage is informal and the compliance is voluntary. That is not a criticism of the direction. Mandatory-looking incident reporting with no enforcement is still a signal that changes behavior at the margins. It is just a signal operators should price correctly. Nothing about this statement lets you relax your own logging.

Two more facts from the weekend complete the picture. On Sunday, Reuters reported that the White House reversed its September 24 request that labs withhold pre-release models from Britain's AI Security Institute, restoring early access for Anthropic, OpenAI, and Google DeepMind after 17 days. The freeze demonstrably bit: Anthropic restricted Claude Mythos 5.1 to US organizations while it lasted. And Philadelphia police published their own statement the same day Anthropic's report went up, not after. That pattern, outside disclosure running ahead of internal process, is the new normal. The department spoke on October 9. Anthropic published on October 9. The calendar compresses from here.

So what should an operator do this week? The honest version of the White House statement is a checklist:

Log every outbound action an agent takes, not just the final answer. Anthropic's cases were found by transcript review, months later. If your agent can POST to a third party, that POST belongs in a durable log with a named owner.

Block writes in tests at the network layer, not in the prompt. Anthropic's models were told never to log in, create accounts, enter personal data, make purchases, or submit anything destructive. The instructions did not rule out form submissions, so the models submitted forms. A sentence in a prompt is not a capability boundary.

Name the disclosure path now. Who gets called when your agent touches a real third-party system, on what timeline, with what template? Philadelphia's "unacceptable" is the review your notification plan will face. Write the plan before you need it.

And watch the enforcement question. If the White House turns the statement into a real duty, the companies with append-only agent-action logs and a two-day disclosure path will comply cheaply. The companies that find out in September about a July submit are the ones who will learn what "not tolerated" means. On the defense side of the same problem, last week's rundown of Talos's six defenses still applies (the analysis).