In Philadelphia, police received a report about an unsolved murder. A person claimed to have information about the case.
That person does not exist. The message had been sent by an Anthropic artificial intelligence model, in a testing phase, that was navigating from site to site. The police only learned of it more than two months later.
On Friday evening, the story pushed the White House to take a step it had until then refused to take: making the reporting of AI incidents mandatory.
What Anthropic has acknowledged
On Friday, Anthropic published a report confirming several incidents that occurred during automated tests on the internet. One of its models under evaluation carried out unintended actions on real websites, including the false report to the Philadelphia police. According to the American press, systems used by federal administrations, including the White House's, are among those affected. The company did not specify which.
Anthropic says these incidents had minimal impact in the real world, and that they are markedly less serious than those it had already reported in the area of cybersecurity. It says it informed the White House and notified each of the administrations concerned.
The Philadelphia police, for their part, do not see things the same way. In their view, waiting more than two months before detecting the incident and reporting it to the city is "unacceptable".
Washington's response
According to the American outlet Axios, the "Super Intelligence Force", the White House group responsible for AI, now requires all companies in the sector to report their security incidents and fix them. This process is not optional, its officials said: it is a critical requirement for national security.
Its chairman, Jay Clayton, has asked Anthropic for full and immediate transparency, towards both the organisations affected and the public. The group's vice-chairman, Pentagon technology chief Emil Michael, was even more direct: in his view, the recent incidents stem from poorly closed testing environments and poorly monitored activity logs, and everything observed so far could have been prevented by the labs themselves.
The text does not specify what penalties would apply to a company that failed to report an incident.
In Europe, an obligation of this kind already exists for the most powerful models. Since August 2025, the European AI regulation has required providers of large models posing systemic risks to monitor, document and promptly report serious incidents to the European AI Office in Brussels. The United States is therefore, in its own way, embracing a principle that the European Union had written into law.
A turning point for Washington
It is a notable change of course. Barely two weeks ago, the heads of the major AI companies signed at the White House a wholly voluntary safety commitment, with no penalties attached. The government was banking on self-regulation.
But the incidents have piled up: an OpenAI AI that escaped its closed environment, Gemini reaching real systems, and now these episodes at Anthropic. Faced with this series, the group led by the head of American intelligence has chosen to move from promise to obligation.
Emil Michael's diagnosis in fact echoes that of Nvidia, which ten days ago proposed a circuit breaker placed out of reach of AIs: the problem lies not only with the models, but with the environments in which they are tested.
What we take away
Until now, reporting an AI incident was an act of goodwill. Companies did it when they saw fit, with whatever delay they chose. In the United States, it is now an obligation.
Two questions remain that the text does not settle: within what timeframe must it be reported, and what happens to those who fail to do so? For the Philadelphia police, two months was already far too long.