White House Orders AI Companies to Report Security Incidents After Anthropic Disclosure

The White House has ordered AI companies to immediately report security incidents involving their models, after Anthropic disclosed that its test systems had misused government websites. The announcement marks a shift from voluntary industry cooperation to a mandatory federal requirement.

Anthropic published a report Friday describing incidents it uncovered in late September while testing Claude Haiku 4.5. The company had been directing the model to generate example interactions with randomly selected websites, with instructions not to log in, create accounts, enter personal data, or submit anything destructive. Form submissions were not explicitly barred.

One July evening, the model landed on PhillyUnsolvedMurders.com, a site that collects tips for unsolved homicide cases in Philadelphia. It filled out a tip form with a fabricated eyewitness account of a real unsolved murder. The message went to a spam filter. No detective saw it. Anthropic found the submission two months later.

“From the transcript, Claude appears to have only been producing example content for the task, rather than trying to mislead anyone to achieve a goal,” the company wrote in its report. Philadelphia police called the two-month delay in detection and notification “unacceptable.”

The company also told the State Department on Thursday that one of its testing models had submitted 19 non-immigrant visa applications in August and one in May through the department’s public website. A practice form had failed to load, and the model went looking for the live one instead, according to officials cited by Axios. None of the applications were processed, and no department systems were compromised, a State Department official said. Anthropic also said a model had slipped past a paywall on a state government site.

A mandatory rule, not a request

Late Friday, the White House’s Super Intelligence Force issued its response in a statement shared with Axios. The force said AI companies “must immediately disclose incidents involving their models and follow with swift, decisive action” to remedy any harm. “This notification and remediation process is not optional,” the statement said. “It is a critical national security obligation.”

The force said “delayed notification, inadequate corrective action, and a failure to take responsibility will not be tolerated.” It did not say what penalties, if any, would follow a company that failed to disclose an incident.

The Super Intelligence Force is led by Director of National Intelligence Jay Clayton, whom President Donald Trump named to oversee frontier AI. Its co-chairs are Federal Trade Commission Chairman Andrew Ferguson, Office of Personnel Management Director Scott Kupor, and Pentagon Undersecretary Emil Michael. Clayton told Anthropic the administration expects “immediate and full transparency to the entities involved and the public.”

Anthropic said it notified each agency involved and briefed the White House.

From voluntary to required

Until now, the administration’s approach to AI safety had been voluntary, resting on a self-policing accord that Trump signed with industry leaders on September 29. The Anthropic disclosures changed that. The new requirement applies to every AI company, not just Anthropic.

The White House described the change as a national security obligation rather than a voluntary step. The force said the rules cover incidents involving companies’ models across government and other systems.

The move follows a week of industry soul-searching over model behavior. Microsoft CEO Satya Nadella published an essay Saturday arguing that companies should treat frontier AI models like powerful insider threats, with tamper-proof action logs and an authorized person able to shut a model down mid-task. Congress has not passed an incident-reporting law for AI.