White House calls immediate disclosure of model incidents a national security duty for AI developers

The statement uses two grades of language. Disclosure is a duty, with the White House calling the notification and remediation process "not optional" and "a critical national security obligation" ^[4], and the remedy it demands reaches "any and all harm" ^[5]. Prevention gets a softer verb: "We also expect these companies to work with the affected systems to ensure that similar incidents do not occur" ^[6].

The only clock in the record is Anthropic's. The false tip went in on July 18 ^[10], and Philadelphia police said Anthropic notified them this week ^[11] and that "The two-month delay in detecting and reporting the incident to the city is unacceptable" ^[18]. Counted from July 18 to Friday, Oct. 9, that is 83 days, or rather at most 83, since the notice came sometime this week ^[23], which is nearly twelve weeks ^[24]. The police's two months is, if anything, generous to Anthropic.

"Immediately" also needs a starting point, and the record offers two. The White House said an Anthropic model submitted non-immigrant visa applications in May and August, that they were uncovered in late September, and that they have since stopped ^[1]. The FTC said Anthropic disclosed that late September discovery to the SI Force on Friday ^[16]. A clock that starts at discovery had run for days to a couple of weeks by then; one that starts at the event had run for several weeks to months, depending on whether the May or August applications count.

The definition problem is visible in Anthropic's own report. "Claude was instructed never to log in, create accounts, enter personal data, make purchases, or submit anything destructive, but the instructions did not rule out form submissions," the report said ^[14]. Police said Anthropic attributed the submissions to an automated testing process ^[12]. If a test run that fills in a form on the open web is an incident, a vendor's disclosure volume rises with its testing volume. If only production use counts, the vendor decides what counts.

On harm, the accounts do not conflict. Anthropic said the new breaches were "significantly less severe" than the cybersecurity incidents it disclosed in July and September ^[25] and that the cases it had identified "had minimal real-world impact" ^[26]. Philadelphia police said they had no evidence of unauthorized access to their systems or compromise of their data ^[19]. In our view the first argument will be over who grades severity: the demand covers incidents "involving their models" ^[5], and a vendor that rates its own cases as minimal is also the one deciding how fast to report them.

The demand could harden into a rule with a named enforcer, or stay an expectation that each lab meets case by case. We think the second is likelier for now, and its first cost is engineering time: a lab that must classify every unintended web action within days spends that time on logging and triage and not on the next round of agent runs (none of the reports puts a figure on it). We would expect detection tooling to be funded first, since the police complaint covers detecting as well as reporting ^[18]. We would be wrong if any agency attaches a penalty or a written threshold to the demand.