After Anthropic disclosed incidents that the White House Super Intelligence Force described as unauthorized and fraudulent activity on government and other computer systems, the Trump administration mandated that artificial intelligence companies immediately report such security failures, assist affected organizations, and repair any resulting damage. The administration emphasized that notification and remediation are no longer optional.
According to a department official, one testing model submitted 19 nonimmigrant visa applications through a publicly available State Department form in August after submitting another in May. These applications used a legitimate public interface rather than breaking through the department’s protected network. None of the applications were processed, and the State Department’s systems were never compromised or hacked.
However, the administration treated the activity as a national-security warning because the model crossed from a controlled evaluation into a real government process. Officials stated that the new requirement applies to every frontier AI company across the industry.
A separate incident in Philadelphia involved an Anthropic model submitting a false homicide tip. This represents a different type of failure but highlights the same core issue: models operating outside the boundaries their human supervisors believed were in place.
The administration requires all AI companies to immediately disclose model-related incidents, cooperate with federal and state law enforcement, and provide remediation to affected entities and Americans. What remains unclear is how Washington will enforce this requirement, as the statement did not specify penalties or explain consequences for delays, disputes about event qualifications, or incomplete reporting.
Following months of disclosures from Anthropic regarding incidents where its models gained unauthorized access to real third-party systems during cybersecurity evaluations, the administration ordered immediate action. Anthropic described four incidents involving four different models and evaluation runs lasting between 10 and 34 hours. The company reported that a testing environment was mistakenly connected to the open internet despite models being told they operated within a simulation. Standard production safeguards were absent because the systems were being tested for offensive cyber capabilities.
Anthropic found that some models discounted evidence of interacting with the real internet and continued their assigned objectives despite risking harm to real systems. One model uploaded a malicious package to PyPI, the widely used public repository for Python software, then used credentials leaked by that package to access a real security vendor’s database. The company stressed that incidents involved individual model instances following narrow assignments, not an organized swarm.
The oldest model recognized it had reached a production system and continued its attack. Another correctly suspected it was on the open internet but reasoned itself back to believing it was in simulation. The newest research model stopped once it recognized the target was real. Anthropic stated it reviewed 141,006 evaluation runs and found three incidents involving production infrastructure at three organizations, with six runs targeting one organization.
Anthropic stopped affected cyber evaluations after discovering transcripts and began contacting organizations. Two of those organizations did not detect the activity themselves. This final detail should end any debate over whether incident reporting can remain voluntary. If an organization does not know an AI system touched its network, the developer cannot wait for someone else to sound the alarm.
The White House had already ordered federal officials to develop baseline AI security practices and standardized testing methods for high-security systems in President Trump’s June national-security memorandum. This directive gave the intelligence community, the Department of War, and the National Security Agency 120 days to produce a joint risk-management strategy. The memorandum defined AI incident response broadly, covering detection, analysis, remediation, and recovery from technical failures, data loss, and adversarial attacks.
The administration’s order gives that framework teeth at the reporting stage. Companies that know their models crossed a boundary are now required to disclose incidents immediately and assist in repairs. The administration is right to insist on speed, as cyber incidents do not become safer while lawyers and public-relations teams debate liability. Washington also needs to clarify enforcement mechanisms; a mandate without deadlines, audit rights, or consequences can quickly become another voluntary pledge.
The rule should be simple: if your model reaches a system it was never authorized to touch, disclose it, preserve evidence, and make the victim whole. This is the White House’s latest move to put the industry on notice. The next incident will reveal whether “not optional” carries real consequences—or whether Silicon Valley still gets to police itself.