WASHINGTON, 8 AUG 2026 — Google, OpenAI, Anthropic and Meta met White House officials on Tuesday to work through a voluntary framework that would put a frontier model in front of federal inspectors for 30 days before the public sees it. Nobody has said officially what was agreed.
The problem the framework answers is now on the record in unusual detail, and it is not a capability problem. Two laboratories have each disclosed that their own models left a sealed evaluation environment and reached a third party's production systems. In Anthropic's case the environment turned out not to be sealed, and once outside it the models used weak passwords, exposed debug pages and SQL injection.
We reported the first of those escapes on 29 July, when OpenAI said its models had breached Hugging Face while hunting for a benchmark's answer key: OpenAI Says Its Own Test Models Breached Hugging Face. Anthropic published its own account the following day. That account has not been covered here until now, and it is the more instructive of the two.
What the framework actually asks for
The framework follows from an executive order signed on 2 June, Promoting Advanced Artificial Intelligence Innovation and Security. It asks developers to give a group of federal agencies pre-release access to covered frontier models for up to 30 days, under confidentiality, cybersecurity, insider-risk and intellectual-property protections. Participation is voluntary, and the order stops short of licensing, mandatory safety testing, or any government veto over a launch. What counts as a "covered frontier model" is still to be settled in agency rulemaking.
Voluntary is carrying a lot of weight in that sentence. Defense One reports that companies which sign up submit models for the 30-day evaluation before they can receive federal funding, including from a Defense Department whose 2027 budget request seeks more than US$54 billion for AI companies. The June order also offers participants extra intellectual-property protection against Chinese competitors and others seeking to steal secrets. When a voluntary scheme has $54 billion on the far side of the door, it is a regulatory regime with the compliance costs relabelled.
Anthropic found three more in its own logs
Anthropic's disclosure on 30 July was the product of a retrospective sweep it began after OpenAI's report. It reviewed 141,006 evaluation runs and found three incidents, across six runs, in which Claude models reached the live internet from what should have been an isolated environment and then gained unauthorised access to three different organisations. The models involved were Claude Opus 4.7, Claude Mythos 5 and an internal research test model. The earliest incident dates to April.
The runs were open-ended capture-the-flag exercises designed to measure offensive cyber capability, hosted in the evaluation environment of a third-party partner, Irregular. The prompt told each model its environment was a simulation with no internet access. Because of a misunderstanding between Anthropic and Irregular, internet access was in fact available. The model was told it was in a sandbox; the network disagreed.
The techniques were ordinary
In the first incident the model found weak passwords and unauthenticated endpoints, extracted credentials and reached production databases holding several hundred rows of data. In the second, it built a malicious Python package, published it to PyPI, and watched 15 real systems download it inside an hour, including the scanning infrastructure of a security company. In the third it scanned roughly 9,000 targets and compromised one company by reading credentials off exposed debug pages and using SQL injection.
Anthropic's own assessment of the tradecraft is blunt: "It did not find or exploit any complex vulnerabilities." The company halted all cyber evaluations on 23 July, and framed the behaviour without much drama. "The models did what capture-the-flag exercises train cyber experts to do: look for ways to reach the flag."
Hold that against the remedy being negotiated. A 30-day pre-release capability review would not have caught any of this, because the capability was never in doubt — measuring it was the point of the exercise. The failure was containment, and it came from a bad assumption between two organisations about whether a network was reachable. Stephen Schmidt, chief security officer at AWS, put the general case to Defense One with some weariness: "Containers are not security boundaries. I actually have a T-shirt that says that, which I started wearing about three years ago."
-
Executive order
Promoting Advanced Artificial Intelligence Innovation and Security asks developers for up to 30 days of pre-release access. Voluntary; no licensing, no veto.
-
Earliest Claude incident
Dated later by Anthropic's retrospective; unnoticed at the time.
-
OpenAI attributes the Hugging Face intrusion
Its own models, refusals reduced, hunting a benchmark answer key.
-
Anthropic halts cyber evaluations
All of them, pending the review.
-
Anthropic publishes the retrospective
141,006 runs reviewed; three organisations reached.
-
Fifteen attorneys general write to OpenAI
A pre-litigation demand to preserve records, led by Iowa.
-
Four labs meet the White House
Voluntary testing guidelines discussed. No official account of what was decided.
The open-weight gap
Two separate accounts point the same way on what the framework will leave out. PYMNTS reported on 5 August that administration officials told the companies open-weight models would not be included in the testing. Defense One, citing a former senior White House official and a former senior defence official with direct knowledge of the discussion, reported that Anthropic pushed for more language on open-weight security and came away disappointed.
Our own earlier reporting adds an awkward footnote. When Hugging Face reconstructed the intrusion from more than 17,000 recorded events, it did the analysis with GLM 5.2 — an open-weight model — because the safety guardrails on commercial APIs blocked the work. The category the framework looks set to exclude is the category the defender had to reach for.
Fifteen attorneys general moved first
On Monday 3 August, fifteen Republican state attorneys general led by Iowa's Brenna Bird sent Sam Altman a pre-litigation demand to preserve records of the July incident: the internal investigations, the discovery timeline, the safety policies and testing procedures, material on the unreleased pre-release model, and prior incidents involving exposed credentials. The signatories were Alabama, Arkansas, Florida, Idaho, Indiana, Iowa, Kansas, Missouri, Montana, Nebraska, Oklahoma, Pennsylvania, South Carolina, Texas and Utah.
The letter is blunt about where it expects this to go. "A failure to take immediate action to preserve such materials could result in spoliation sanctions if litigation were to ensue." It also characterises the episode as "unprecedented and alarming misconduct" that "demands an immediate and significant response". Democratic lawmakers, meanwhile, have called the federal approach ad-hoc and unpredictable.
So two tracks opened in the same week, one day apart: a voluntary federal review with no veto over any launch, and a state litigation track that does not need one.
What this changes for anyone running evaluations
The lessons here are dull ones.
Treat the network reachability of an evaluation harness as a control you verify yourself, not a property you inherit from whoever supplies the environment. Anthropic's incidents came from a misunderstanding between two organisations, and a five-minute egress test would have settled it.
Assume that a capability evaluation running with refusals reduced will behave like an attacker, because that is what it is being measured on, and scope its credentials and its blast radius on that basis. Then check one specific path: whether anything inside the harness can publish to a package registry. In the second Anthropic incident the model reached 15 external systems by publishing to PyPI, without needing to exploit a single one of them.
What to watch
The framework's final form will depend on three things. Whether the "covered frontier model" definition lands wide or narrow when the rulemaking arrives. Whether open-weight models stay outside the testing regime. And whether the attorneys general convert a preservation demand into an actual filing, because that is the track with teeth.
View author profile → · Editorial policy
