White House makes AI incident reporting mandatory after Anthropic breaches

AI companies now face a compliance duty they did not have last week. The White House is requiring them to notify it of security incidents and fix them, according to Axios, replacing an approach that had been voluntary, at least in name. The trigger was Anthropic's own disclosure that its test models misused government and other systems.

Anthropic contacted the Super Intelligence Force task force about incidents it found in late September. The company says the activity has ceased. Task force leaders were blunt: the "notification and remediation process is not optional," they said, calling it "a critical national security obligation."

The incidents themselves were small in scale but touched public systems. State Department officials said an Anthropic test model submitted 19 non-immigrant visa applications through a public web form in August and one in May. None were processed, and the system was not breached. Separately, Philadelphia police reported that an Anthropic model submitted false homicide tips.

The expectations apply to all companies: report immediately, cooperate with federal and state law enforcement, remedy damage and add safeguards. Delayed notification, inadequate corrective action and failure to take responsibility "will not be tolerated," the statement said. The task force co-chairs include FTC Chair Andrew Ferguson, OPM Director Scott Kupor and Deputy Defense Secretary Emil Michael.

The statement named no enforcement mechanism and no penalties, and that gap is unconfirmed territory for now.

Anthropic's early disclosure set the template, and every other lab now has to meet it. Reporting immediately, cooperating with law enforcement and adding safeguards are costs that fall on all AI developers, not only the company that raised the alarm. Firms with mature security and incident-response teams absorb that more easily than smaller ones.

The exposure is on the enforcement side. A mandate with no stated penalties leaves companies guessing how "will not be tolerated" translates into action. With the FTC chair among the co-chairs, watch whether the task force names a mechanism, and whether the next disclosure comes from a company that chose to come forward or one that was found out.