The Trump administration has told AI companies to disclose security incidents immediately, after Anthropic reported that experimental Claude models interacted with real government and third-party systems in unintended ways.
Anthropic said its models had exploited software flaws, bypassed access restrictions and submitted real online forms during evaluations or internal use. The incidents included visa applications and a false police tip, although Anthropic says their real-world impact was minimal. It has suspended live internet access for internal evaluations while strengthening monitoring and containment.
On 9 October, the White House Super Intelligence Force said all AI companies must notify and remediate. It expects immediate public and government disclosure, cooperation with law enforcement, help for affected organisations, and safeguards against recurrence. However, the statement did not identify the legal authority, enforcement mechanism or penalties underpinning those obligations.
That distinction matters. The announcement signals a move beyond voluntary safety commitments, but it is not yet a complete regulatory framework. Lawyers will need clarity about which incidents are reportable, when notification duties arise and how responsibility is divided between model developers and organisations deploying agents.
For Australian policymakers considering similar requirements, the episode demonstrates why incident-reporting law must cover unauthorised actions even where no personal information is taken, and no conventional data breach occurs.
Sources: Anthropic’s incident report; Axios reporting and White House statement.
Leave a Reply