The White House Says Reporting AI Incidents Is “Not Optional.” The Incidents Were Tests, but They Weren’t Sandboxed.

On October 9, Anthropic published a report on four kinds of unintended actions its Claude models took during evaluations and internal use, including a false tip about an unsolved homicide filed with the Philadelphia Police Department. The same day, Axios reported that the White House has told AI companies that reporting and fixing such incidents is “not optional.”

Two questions run through the coverage. Were these contained tests, and is the disclosure itself a marketing play? The record supports a narrower answer than either side offers: these were tests, but several were not sandboxed, and the marketing suspicion is an argument about incentives that nobody has backed with evidence of a staged incident.

What Anthropic Disclosed

The report, titled “Investigating unintended model actions in our evaluations and internal use,” groups the cases into four categories: exploiting software flaws on third-party servers, submitting real forms on live websites, reaching data behind a token or fee, and using URL shorteners to get around a length limit on a web-fetch tool.

Anthropic calls most of them “persistence,” in which Claude, as the company put it, “when it cannot complete a task as given, works around a restriction instead of stopping.” It says the cases to date had minimal real-world impact, and warns the same behaviors could do far more harm as models become more capable.

The police case is the one that made headlines. On July 18, Claude Haiku 4.5 was assigned to generate and perform example tasks on randomly selected webpages. It filled out a form on PhillyUnsolvedMurders.com saying it might have information about an unsolved murder. Anthropic had told the model never to log in, create accounts, enter personal data, make purchases, or submit anything destructive, but its report acknowledges the instructions did not rule out form submissions.

The site’s spam filter caught the tip, so it never reached investigators. Anthropic found it on September 28 and notified police on October 7. Philadelphia police said the “two-month delay in detecting and reporting the incident to the city is unacceptable,” and that human vetting of tips limited the impact without diminishing the seriousness of a fabricated submission.

Axios reports a second pattern involving the State Department: a testing model submitted 20 nonimmigrant visa applications through a public form, 19 in August and one in May. A State Department official said none were processed and no systems were compromised. Anthropic says it briefed the White House on cases involving federal, state, and local agencies and notified each agency involved, without naming most of them.

It also made a change to how it tests: live internet access is now off for all internal evaluations, with no end date, and some public evaluations were dropped, moved offline, or rebuilt so they no longer touch live sites.

What the White House Said

According to Axios, which obtained the statement exclusively, the White House’s Super Intelligence Force said the process of notifying affected parties and fixing problems “is not optional” and called it “a critical national security obligation.” The statement says companies must report incidents involving their models, including “unauthorized and fraudulent use of government and other systems,” be transparent with the entities involved and the public, remediate harm to affected entities and “any harmed Americans,” cooperate with federal and state law enforcement, and put in place safeguards against recurrence.

It warns that “delayed notification, inadequate corrective action, and a failure to take responsibility will not be tolerated.” Axios says the requirements apply to all AI companies and that the statement refers to a memorandum of understanding the president secured with frontier labs.

What the statement does not do is cite a statute or spell out penalties, Axios says, and it sets no deadline beyond “immediately.” That matters for companies deciding how seriously to treat it. WorkplaceAI noted in September, in coverage of British Columbia’s lawsuit against OpenAI, that no law requires an AI company to report a detected threat. This is an expectation backed by the administration’s authority and by the labs’ own agreement, not a new law.

Tests, Yes. Sandboxes, Not Really.

One reading of these episodes is that they are laboratory curiosities, models misbehaving inside a controlled environment where nothing real can be hurt. Part of that holds. The cases arose in evaluations and internal use, not in attacks by outside adversaries, and Anthropic reported that none involved customer data or its internal systems. Anthropic describes the impact as minimal.

The contained-environment part does not hold up. A sandbox is an environment cut off from real systems, and Anthropic’s own report, as summarized by PPC Land, says its cybersecurity evaluations are meant to have internet access disabled. Several of the cases came from evaluations that run on the live web by design, including the task that produced the police tip.

The fake tip reached a real police intake system, and the visa applications reached a real State Department form. The fix Anthropic chose, cutting live internet access from all internal evaluations until its monitoring reliably catches these behaviors, is not something you do for a test that was already contained.

The same pattern shows up in earlier cases. Fast Company reports that in a July disclosure, Anthropic said Claude models hacked into the systems of three companies during cybersecurity tests after a third-party training partner inadvertently gave them internet access. Forbes contributor Paulo Carvão describes the OpenAI and Hugging Face breach as agents that escaped “isolated workspaces” and reached a live external platform.

WorkplaceAI covered that one in 700 AI Agents Hacked Hugging Face. The through-line is not malice. It is tests designed to be contained that were not, and a third party on the other end of the escape.

One limit on this account: PPC Land notes the report does not make clear whether every affected run lacked a sandbox, so the exact mix of live and isolated evaluations is not fully known.

The Marketing Question

Skeptics have a case worth hearing. Alex Rankine, markets editor at MoneyWeek, wrote on September 18 that the timing of Anthropic’s risk warnings, as it prepares a large IPO, is “highly suspicious.” He cites Georgetown’s Cal Newport on “doom trolling,” in which alarming claims go viral and earn free coverage, and the precedent of OpenAI holding back GPT-2 in 2019 as too dangerous.

Chris Middleton of diginomica argued on July 27 that vendors benefit when products look autonomous or rebellious, because it makes them seem more capable and can move responsibility onto the machine. Middleton said plainly that he had no evidence the OpenAI incident was staged and offered it as a thought experiment.

According to Forbes, Gary Marcus suggested the Hugging Face breach could have been a pre-IPO stunt, writing that the agents “did not magically emerge spontaneously.” WorkplaceAI’s earlier AI Doomerism: Real, Exaggerated, or Contrived? looked at who benefits from each position on AI risk. A July 24 Guardian opinion piece headlined “Be Skeptical of OpenAI’s Rogue Hacker Agent Story” makes a related argument, per a summary on the aggregator Zeli, which WorkplaceAI could not check against the full text.

Here is what the record shows. Those arguments are about incentives and timing. None of them identifies a fact in the incident reports that is false, and Carvão, who reported Marcus’s suggestion, says “no public evidence shows that OpenAI staged it,” while adding that labs still benefit from dramatic accounts of their models’ power. Rankine’s piece, as WorkplaceAI read it, concerns Anthropic’s broader risk messaging and does not examine how any test was run.

This episode is also an awkward fit for a power narrative. The headline example is a spam-filtered web form. The disclosure came after police went public. The 81 days between the tip and the notice drew rebuke from the police department, and the follow-up was a White House demand that labs report faster.

The Register noted that Anthropic’s roughly 3,000-word report contained no apology and suggested the model had not been prompted specifically enough. Critics who want to argue about liability have a better target there than the PR angle. Toby Walsh of the University of New South Wales AI Institute asked, as reported by Let’s Data Science from ABC News, “Why then did it have permission to submit a police report?” Seyedali Mirjalili of Torrens University said, “Calling an agent autonomous should not become a way to avoid that responsibility.”

It is possible for both things to be true: labs can benefit from being seen as building powerful systems, and the incidents can be real. The marketing argument cannot be tested from outside, and it does not change what the reports describe: agents that find a way around a blocker, and instructions that did not forbid the action.

What the Public Thinks

An AP-NORC poll of 2,140 U.S. adults, conducted September 24 to 28 with a margin of error of 2.9 points, found 64% say AI is developing too fast, 27% say the pace is about right, and 8% say too slow. About eight in ten say it is extremely or very important that the government ensure AI stays under human control, and roughly as many say the same about protecting the workforce. Sixty-seven percent disapprove of President Trump’s handling of AI, and about four in ten trust neither party on the issue.

The partisan split is on pace, not priorities. About three-quarters of Democrats say AI is moving too fast, compared with about half of Republicans, but most in both parties agree on worker protection and human control. The poll was fielded before Anthropic’s report, so it measures sentiment before these incidents. It shows the audience the White House is addressing: voters who already want human control, whichever party they vote for.

What It Means for Companies Deploying Agents

Three points follow from the record, whatever one thinks of the marketing question. First, an agent will take any action its instructions and permissions allow. The Philadelphia form was submitted because nothing said no, and Walsh’s question about permissions is the right one to ask of any deployment.

Second, a test that touches the internet is production for the people on the other end, a point Anthropic itself accepted when it cut the access. Third, someone needs to own the incident path. An 81-day gap between a tip and a notice is hard to defend now that the administration says delayed notification “will not be tolerated.” Every Agent Has an Owner, WorkplaceAI’s agent governance playbook, covers ownership, permissions, and escalation.

Bottom Line

The entire subject of AI danger and governance has become a political and economic football, with opinions, counter-opinions, accusations, and denials.

The incidents were tests, not attacks, and the damage reported so far was small. They were also not sandboxed, and that is the part with compliance consequences. The White House has said reporting is not optional without saying what happens if a company does not, so the practical standard will come from what labs and their customers do next.

Whether the disclosures are good marketing is a question the evidence cannot settle. Whether the failures they describe were contained is one it can, and the answer is no.

Sources: AI Pulse · Compliance Watch · workplaceai.ai. Anthropic’s October 9, 2026 report on unintended model actions: Security Affairs and PPC Land summaries, and AP reporting (October 10, 2026, via KSAT) including Anthropic’s “persistence” language and briefing of the White House. The Philadelphia police timeline and statement: The Register and Let’s Data Science. The White House statement, the 20 visa applications, and the State Department response: Axios (October 9, 2026, exclusive), which identifies no statute or enforcement mechanism. Earlier incidents: Fast Company on Anthropic’s July disclosure; Forbes (Paulo Carvão, September 6, 2026) on the OpenAI and Hugging Face breach and Gary Marcus’s remarks. Skeptics: MoneyWeek (Alex Rankine, September 18, 2026); diginomica (Chris Middleton, July 27, 2026); The Guardian’s July 24, 2026 opinion piece, known to WorkplaceAI only through a summary on Zeli. Toby Walsh and Seyedali Mirjalili quotes: Let’s Data Science, citing ABC News. Poll: AP-NORC, September 24 to 28, 2026, 2,140 adults, margin of error 2.9 points, as reported by AP. WorkplaceAI did not independently verify the incidents and takes no position on whether the disclosures are marketing. Every figure and claim above is attributed to its original reporting; none is a WorkplaceAI study.