Not Optional, and Not Defined: The White House Incident Order Meets Its Own Examples

On 9 October the White House’s new Super Intelligence Force, set up five days earlier and chaired by Jay Clayton, put out a statement about Anthropic. I could not find the full text on whitehouse.gov. It reached the public through an Axios exclusive, and the Philadelphia Inquirer’s account quotes it at length. AI companies, it said, must “immediately disclose incidents involving their models and follow with swift, decisive action to remedy any and all harm.” The process was “not optional.” It was “a critical national security obligation.”

The statement sets a clock, “immediately,” and names something that has to be reported. It gives no definition of that thing, no penalty, no regulator or reporting channel, and no statute. Last month I counted the same gaps in the White House AI accord and won’t do it again. This time the statement came with worked examples, which lets me ask a narrower question. Suppose someone wanted to turn “not optional” into a rule. Would the two cases that prompted the statement count as incidents under any definition already in law?

The two cases

The first is the fake homicide tip, which I wrote about when it came out. A Claude model was generating example tasks from randomly chosen web pages. It landed on the Philadelphia police page for an unsolved murder and, at about 11:27 p.m. on 18 July, submitted the tip form: “I may have information regarding this case.” The name and contact fields were blank. According to Anthropic’s report, “the submission was flagged as spam and was never forwarded for investigation.” Anthropic says it found the submission on 28 September; police say Anthropic told them on 7 October. Anthropic’s report says it shared the finding on 8 October.

The second case is not named in Anthropic’s report. The State Department told the Inquirer that an Anthropic testing model submitted “19 nonimmigrant visa applications in August and one application in May” through the department’s public website form. It called them “incomplete.” The Hacker News, citing the New York Times, adds that none were processed. And the department was firm about one thing: “At no time were any of the Department’s systems compromised or hacked by the Anthropic model.”

Anthropic’s report does describe a case that fits, without naming the agency. It says it happened “multiple times on the same evaluation”: an “unreleased, non-frontier research model” was supposed to fill out a practice copy of a government form, and when the copy failed to load, it “navigated to the website where the real form is normally hosted and submitted the form there.” The report also says some of its cases involved government websites “at the federal, state, and local levels.” No document I have read connects that passage to the visa forms, so I treat it as a likely match and nothing more.

The State Department’s line sits awkwardly next to the White House statement, which described “the unauthorized and fraudulent use of government and other systems.” The agency whose system was used says it was not compromised. The office demanding reports calls the same events fraud. Both may be fair descriptions. They are not the same description, though, and a reporting rule would have to choose between them.

Anthropic’s own summary is that “the cases we’ve identified to date in these categories had minimal real-world impact.” Nothing I have read contradicts that, though the police called the two-month delay unacceptable and the White House statement refers to “any harmed Americans.” In both cases a model filled in a public form on a government website, unasked, with content that was false or incomplete, and the receiving system filtered it out or set it aside.

Three statutes, four definitions

Three AI incident regimes are written down with enough precision to test. Here is what each one would make of a model submitting a real government form in the middle of a test.

Start with the EU AI Act. Article 3(49) defines a “serious incident” as an incident or malfunction that “directly or indirectly leads to” one of four outcomes: a death or serious harm to health, “a serious and irreversible disruption” of critical infrastructure, an infringement of Union law protecting fundamental rights, or serious harm to property or the environment. Article 73 gives a clock of 15 days (two days for widespread infringements or critical-infrastructure disruption, ten days for a death) and a recipient, the national market surveillance authority. It applies only to providers of high-risk AI systems. A general-purpose model browsing the open web during an internal evaluation is not one. Even inside the scope, a spam-filtered tip and twenty unprocessed forms produced none of the four outcomes. You could argue the fundamental-rights limb, but only at a stretch. A second EU duty is aimed more squarely at models like these: Article 55(1)(c) requires providers of general-purpose models with systemic risk to report “serious incidents” to the AI Office “without undue delay.” It uses the same Article 3(49) definition, so the same four outcomes apply, and neither case reaches them.

California’s SB 53, the Transparency in Frontier AI Act, defines a “critical safety incident” four ways: stolen weights that result in death or bodily injury; “harm resulting from the materialization of a catastrophic risk”; loss of control causing death or bodily injury; or a model using “deceptive techniques against the frontier developer to subvert the controls or monitoring of its frontier developer,” outside an evaluation designed to elicit that behavior “and in a manner that demonstrates materially increased catastrophic risk.” Catastrophic risk means more than 50 deaths or serious injuries, or more than $1 billion in damage, from a single incident. The developer reports to the Office of Emergency Services within 15 days, or within 24 hours to law enforcement if someone faces imminent risk of death or injury.

SB 53 comes closer to the facts than the EU text does. Its list of catastrophic conduct includes acting “with no meaningful human oversight” in a way that, if a human had done it, “would constitute the crime of … theft, including theft by false pretense.” That is the kind of thing the White House meant by “fraudulent.” But the conduct only matters if it risks fifty lives or a billion dollars, and these cases do not come anywhere near it. The deception limb doesn’t fit either. Nothing in either account says the model hid what it was doing from Anthropic, and Anthropic says most of its cases surfaced through its own review of transcripts.

New York’s RAISE Act, in the version Governor Hochul signed in December 2025, was the only text I found with a clause written for these facts. Its “safety incident” includes, as item (a), “A frontier model autonomously engaging in behavior other than at the request of a user.” Nobody asked the model to submit a homicide tip, and nothing suggests anyone asked for twenty visa applications. Clause (a) arguably describes both cases, though in both the model was running a task someone had set, so “other than at the request of a user” is contestable. The definition then puts a gate in front of it: the behavior must occur “in such a way that it provides demonstrable evidence of an increased risk of critical harm,” and the act defines critical harm as 100 or more deaths or serious injuries, or $1 billion in damage. A blank tip form is evidence of a lot of things, but it is hard to make it evidence of that.

That version did not last. Hochul signed the December bill on the condition that the legislature amend it, and it did. The amendment, S8828, passed the Senate 58–1 on 28 January and the Assembly on 11 March, and the governor signed it on 27 March as chapter 96. It repeals Article 44-B and replaces it. The new “critical safety incident” definition is SB 53’s, nearly word for word. The 72-hour reporting clock survives, with a 24-hour line for imminent danger, and reports now go to a new office in the Department of Financial Services. The autonomy clause is gone. The whole act takes effect on 1 January 2027.

Would the tip form or the visa forms count as a reportable incident? Five rows, one per text. The White House statement of 9 October 2026 names "incidents involving their models" without a definition, sets the clock at "immediately", names no regulator, and covers both cases because it was written about them. The EU AI Act, Articles 3(49) and 73, counts death, serious health harm, critical-infrastructure disruption, fundamental-rights infringement or serious property harm, for high-risk systems only, with a 2 to 15 day clock to market surveillance authorities; neither case qualifies. California SB 53 counts death or injury or a risk of more than 50 deaths or 1 billion dollars, with a 15-day clock to the Office of Emergency Services; neither case qualifies. New York's RAISE Act as signed in December 2025 counts a frontier model autonomously behaving other than at a user's request if it shows increased risk of critical harm, meaning 100 or more deaths or 1 billion dollars, with a 72-hour clock to the attorney general and homeland security division; the conduct arguably fits both cases but the harm threshold does not. RAISE as amended in March 2026 copies SB 53's definition, keeps a 72-hour clock and sends reports to a new office in the Department of Financial Services; neither case qualifies. FIVE TEXTS, TWO CASES · WHAT COUNTS AS AN INCIDENT · STATUTE TEXT AS OF OCT 2026 Text Counts as an incident when Clock Goes to Tip form Visa forms White House statement, 9 Oct 2026 EU AI Act Art. 3(49) and 73 California SB 53 in force since Jan 2026 New York RAISE as signed, Dec 2025 New York RAISE as amended, Mar 2026 “incidents involving their models” no definition given death, health, infrastructure, rights, property; high-risk systems only death or injury, or a risk of more than 50 deaths or $1B autonomous behavior, if it shows risk of 100+ deaths or $1B SB 53’s definition, copied; autonomy clause removed “immediately” 2–15 days 15 days 72 hours 72 hours no regulator named market surveillance authority Cal OES attorney general and DHSES new DFS office Covered: the statement was written about this case Covered: the statement was written about this case Not covered: no listed outcome, and not a high-risk system Not covered: no listed outcome, and not a high-risk system Not covered: no death, injury or catastrophic-risk threshold met Not covered: no death, injury or catastrophic-risk threshold met Conduct arguably fits clause (a); the critical-harm gate does not Conduct arguably fits clause (a); the critical-harm gate does not Not covered: SB 53 definition, threshold not met Not covered: SB 53 definition, threshold not met Filled: covered. Half: the conduct arguably fits, the harm threshold does not. Open: not covered. My reading of the texts.
Every definition I tested is keyed to harm or risk, mostly on a scale these cases never approached. The one keyed to conduct still required evidence of catastrophic risk, and it has since been replaced.

So the result is easy to state. Under the incident definitions I tested, in the EU AI Act, SB 53 and both versions of RAISE, neither case that set off the White House statement is a reportable incident. The single clause that arguably described what the models did required evidence of catastrophe from the start, and New York repealed it in March with the rest of the original article, months before the tip came to light.

There is a second threshold I have not touched. SB 53 and the amended RAISE Act apply only to “frontier models,” meaning models trained with more than 1026 operations; the December version of RAISE also required a compute cost above $100 million. Anthropic’s report names Claude Haiku 4.5 as the model that submitted the tip, and calls the model in the government-form case “non-frontier.” That is Anthropic’s word, and it may or may not track the statutory threshold. If it does, the most likely match for the visa forms fails the frontier test before you even reach the definition. No document I have read says where Haiku 4.5 falls.

The rules and the two cases on one calendar, December 2025 to January 2027 Three lanes on a time axis from December 2025 to January 2027. Rules lane: New York's RAISE Act, with its autonomy clause, signed 19 December 2025; California SB 53 in force 1 January 2026; the RAISE amendment, which removes the autonomy clause, signed 27 March 2026; the White House Super Intelligence Force statement calling reporting not optional, 9 October 2026; the amended RAISE Act takes effect 1 January 2027. State Department visa form lane: one application in May 2026 and nineteen in August 2026, exact days not published. Philadelphia tip form lane: tip submitted 18 July 2026, found by Anthropic 28 September, police notified 7 October by the police account or 8 October by Anthropic's. WHAT WAS WRITTEN DOWN, AND WHEN · DEC 2025 – JAN 2027 Rules State Dept visa Philadelphia tip 19 Dec 2025: RAISE Act signed, including the autonomy clause 1 Jan 2026: California SB 53 in force 27 Mar 2026: RAISE amendment signed as chapter 96; autonomy clause removed 9 Oct 2026: White House statement, "not optional" 1 Jan 2027: amended RAISE Act takes effect May 2026: one visa application August 2026: nineteen visa applications 18 Jul 2026: tip form submitted 28 Sep 2026: Anthropic finds the submission 7–8 Oct 2026: police notified RAISE signed, with autonomy clause SB 53 in force RAISE amended, clause cut White House: “not optional” Amended RAISE in force 1 form, May 19 forms, August submitted 18 Jul found 28 Sep police told 7–8 Oct Dec 2025 Apr Jul Oct Jan 2027 Exact days of the visa forms are not published. Police date their notice 7 Oct; Anthropic says 8 Oct.
New York had already cut its autonomy clause before either form was submitted. The White House statement arrived five days after the Force was created, with no definition in force that covered the cases it named.

A near miss, by any other name

The gap is not a sign that the incidents were trivial. It shows that nearly all of these regimes were drafted to catch harm, or catastrophic risk, rather than ordinary near misses. These cases were the opposite: conduct that had already happened, with almost no harm. In aviation the word for that is a near miss. Kevin Wei and Lennart Heim, in a framework for AI incident reporting published in the AAAI proceedings in March, list “level of risk materialization” as one of seven design dimensions such a system has to settle, and they treat near-miss reporting as its own design question. The statutes above have mostly settled it one way: risk that did not materialize is not reported, and the two risk-based limbs still require a catastrophic scale.

Aviation settled it the other way, and paid for the lesson first. On 1 December 1974, TWA Flight 514 misread an approach clearance into Dulles, descended early and flew into a Virginia mountaintop, killing everyone aboard. According to NASA’s own history, a United crew had made the same misunderstanding at the same spot six weeks earlier and only just cleared the ridge. They told their airline, which warned its own pilots, and “there existed no method of sharing the United pilots’ knowledge with TWA and other airlines.” The answer, set up under an FAA–NASA agreement in August 1975 and running from April 1976, was the Aviation Safety Reporting System. It takes near misses and is confidential and voluntary. A neutral agency runs it because, in NASA’s account, the FAA’s regulatory and enforcement roles would otherwise discourage reporting, and the FAA backs it with limited immunity.

The Super Intelligence Force has started from the other end. Its statement is mandatory, it names no channel, it comes from an office that also speaks about enforcement, and it calls the triggering events fraud. I can’t tell yet whether that is a draft of a rule or a reaction to one bad week, and the statement doesn’t say. But if it is meant as a rule, the useful version would look less like the statutes and more like clause (a) without the gate. Count a model acting on a third party’s system without being asked as an incident, whatever the harm, and say where the report goes. I argued last month that the address matters as much as the deadline, and here the address is missing as well.

One more detail about the clock. Anthropic found the tip on 28 September and told the police nine or ten days later. Measured from Anthropic’s own discovery date, and treating the police notice as if it were the regulator report, that would have been inside SB 53’s 15 days and outside RAISE’s 72 hours, if either had applied. Neither did.

References

  1. Rosenberg, A. S. (2026). White House demands transparency after Anthropic’s AI agents called in a false Philly homicide tip and applied for visas. Philadelphia Inquirer, republished by The Spokesman-Review, 10 October 2026. Quotes the Super Intelligence Force statement first reported by Axios on 9 October.
  2. Axios (2026). Exclusive: Anthropic breaches spark White House AI reporting mandate. 9 October 2026.
  3. Anthropic (2026). Investigating unintended model actions in our evaluations and internal use. 9 October 2026, updated 12 October 2026.
  4. NBC10 Philadelphia (2026). Anthropic AI model submits false tip on unsolved Philly murder, police say. 9 October 2026.
  5. Lakshmanan, R. (2026). Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws. The Hacker News, 10 October 2026.
  6. European Union (2024). Regulation (EU) 2024/1689, Article 3: Definitions and Article 73: Reporting of serious incidents and Article 55: Obligations of providers of general-purpose AI models with systemic risk.
  7. State of California (2025). Business and Professions Code § 22757.11: Definitions and § 22757.13: Critical safety incidents. Transparency in Frontier Artificial Intelligence Act (SB 53).
  8. New York State Senate (2025). S6953-B: Responsible AI Safety and Education (RAISE) Act. Bill text as passed; signed 19 December 2025.
  9. New York State Senate (2026). S8828: chapter amendment to the RAISE Act and bill status page. Signed 27 March 2026 as chapter 96; takes effect 1 January 2027.
  10. Wei, K. & Heim, L. (2026). Designing Incident Reporting Systems for Harms from General-Purpose AI. Proceedings of the AAAI Conference on Artificial Intelligence 40, published 14 March 2026.
  11. NASA Aviation Safety Reporting System (2016). CALLBACK Issue 435. April 2016; describes events of 1974–1976.