For years, reporting a misbehaving model was a matter of goodwill. On October 9, that changed, at least on paper.
What was announced
The White House’s new Super Intelligence Force, created days earlier, told every SI company operating in the US to immediately disclose security incidents involving their models. Companies must also remedy harm, cooperate with law enforcement and put safeguards in place to prevent repeats.
“This notification and remediation process is not optional.”— White House statement to Axios
What triggered it
The statement followed Anthropic’s disclosures of unintended model actions, including a fabricated tip sent to Philadelphia police and 20 incomplete visa applications filed on a State Department website. None were processed, and the department said its systems weren’t compromised.
The open questions
- No definition of what counts as an “incident”.
- No named recipient, deadline or penalty.
- No new statute behind it, so analysts treat it as an expectation, not binding law.
The task force is also running a 120-day review of SI risks that could add teeth.
What to do now
Law firm Pillsbury advises widening internal definitions of a “security incident” to cover agents acting within their permissions but beyond their approved purpose. Logging what an agent touched, and when, is fast becoming a compliance requirement.