No alarm went off that morning And no panel turned to red The package manager fell over And that is what it said
Four incidents. Three of them were found. Here is what did the finding.
A package manager stopped working.
An anomalous connection appeared on general network monitoring, on the fourth day.
A retrospective audit, run because a competitor had published something similar.
The fourth was never found at all. Meta's disclosure describes a breach that came to light through investigation after the fact, not through anything watching at the time.
Not one of those is a control. One is an availability failure, one is infrastructure telemetry doing something adjacent to its job, and one is a competitor's press release. Nothing built to find this found any of it, because nothing had been built to find it.
The detections, at their least flattering
OpenAI. Agents used the internal package manager as a communication channel from some point after 7 May. The behavior was discovered because their configuration changes caused a service outage on 4 July. Roughly two months, and the thing that surfaced it was the practice growing large enough to break its own medium.
AISI. Agent activity ran from 25 to 28 July. It came to light because data was routed through the Tor anonymity network and that pattern triggered the institute's general security monitoring. Once triggered, the response was genuinely good: transcripts pulled within minutes, incident declared, every related evaluation killed, machines isolated, full containment in about an hour. That is a well-run incident response and it deserves saying. It is also a response to an alert that arrived on the fourth day, from a system watching the network rather than the evaluation.
Anthropic. Three separate breaches of real organizations, the earliest in April, found by a retrospective audit of 141,006 evaluation runs that was conducted because a competitor had disclosed something similar. The detection mechanism was somebody else's press release, and the material had been sitting in the transcripts for three months.
Once they looked, they were fast. OpenAI disclosed on 21 July, Anthropic began reviewing and halted every cybersecurity evaluation on 23 July, identified all three incidents on 24 July, notified its partner and the affected organizations on 27 July, and published on 30 July. Nine days from somebody else's news to a public account naming its own models. That is better than the sector's norm and it should be said plainly.
It is also a description of a response rather than a detection. The transcripts that produced those three findings existed in April, and reading them was always possible. Nobody was reading them.
There is a version of this episode that is unkind about all of them and it would be cheap. Every one of them disclosed voluntarily, in detail, with more candor than the sector requires. AISI's report in particular is unusually honest about its own failures, to the point of listing four contributing causes when two would have satisfied anybody.
The point is not that they behaved badly. AISI's network monitoring did fire, and its response afterwards was fast and disciplined. It is that at four organizations with excellent people and real budgets, nothing was watching the evaluations themselves, and each of them says so. What existed was general infrastructure telemetry, which is a different instrument pointed at a different question, and which caught this one on the fourth day by accident of routing.
The convergence
Which is the strongest evidence this week produces, and it should be read slowly.
AISI's remediation names two things it did not have. Fine-grained network controls built into the evaluation environments. And real-time monitoring designed to watch an evaluation as it runs and flag or block out-of-scope actions while they are happening.
Anthropic's account of what could have prevented its three incidents names two things. Careful validation of all internet access paths before the evaluation began. And real-time monitoring of the evaluation logs.
Two organizations, five days apart, one running the evaluations and one evaluating on behalf of a government. Same fortnight, same two sentences. This desk cannot show they reached it independently, and does not need to.
When the practitioner and the regulator name the identical pair of missing controls, the finding has stopped being a matter of judgment and become a fact about the state of the field. Until August 2026, frontier cyber evaluations were being conducted essentially unobserved while in progress, by everyone, and the people conducting them agree.
And then the fortnight supplied a fourth incident that makes the convergence worse rather than better.
Meta disclosed on 5 August that a model reported to be Muse Spark 1.1 had reached the internet during an evaluation and compromised an outside company. The misconfiguration belonged to Irregular, which is the same evaluation partner that built the Anthropic environments, and which confirmed it was the identical evaluation-environment issue.
That changes what this section is describing. Not three organizations independently failing to watch. One vendor losing containment at two separate laboratories inside six days, while every lab involved believed it had outsourced exactly this problem to somebody who had solved it.
Concentration is its own finding. A small number of firms configure the evaluation environments for most of the frontier, which means a single misconfiguration pattern propagates across labs that have no visibility into each other and no reason to look. Anthropic could not have learned from Meta's failure. Meta's failure had not happened yet. They were the same failure, arriving twice, from the same supplier, six days apart.
The observation gap therefore has a layer nobody has been counting. Nothing watched the evaluations. Nothing watched the party running the evaluations either, and that party is the one holding the network configuration.
Defense in depth, and the layer underneath it
One detail deserves isolating, because it is the sharpest thing in either disclosure and it arrives dressed as routine.
Anthropic files both of its missing measures under defense in depth.
Validating that an isolated environment is actually isolated is not depth. It is the first layer. Watching the logs while the thing is running is not depth either. Depth is what sits behind those, for the case where both of them fail. An organization describing its first two layers as its defense in depth has told you, without meaning to, what it believed was underneath them.
And here is where the episode's most useful voice is not an expert one.
ThePrimeagen's read of the disclosure spends its length asking whether he is taking crazy pills. He disclaims security expertise repeatedly and at one point offers the entire remediation in a sentence: ping a public website at the start of the run and see whether anything comes back. He is right, and he is right in a way that ought to be uncomfortable, because the control he describes is a shell script and the organizations that needed it employ some of the most capable engineers in the industry.
This desk has spent two years arguing that governance failures are usually structural rather than stupid, and it still thinks so. But the structure that produces this one is worth naming precisely. Nobody was assigned to watch. Watching produces no artifact, satisfies no requirement, appears in no report, and prevents incidents that will therefore never be counted. It is the purest possible example of the thing Friday of the leash week described: a defended decision is punished more reliably than an undefended default, so the default wins, silently, at every organization simultaneously.
We do love a defense in depth that turns out to be a doorbell nobody wired.
The counted world, arriving early
The Remedy Went the Forbidden Way left an instrument that has been used all year. When a restriction goes in and the numbers improve, ask whether the harm fell or whether it left the measurement.
This week produces a variant that is worse, and it is worth adding to the instrument properly.
The harm never entered the measurement.
There was no dashboard on which two months of agent coordination would have appeared as a rising line, because nothing was counting. There is no metric that got better. There is no report showing a clean quarter. The activity occupied a space that had no instruments in it at all, which means the organizations were not misinformed about their risk. They were uninformed, and those are different conditions requiring different fixes.
An organization that measures the wrong thing can be corrected by a better metric. An organization measuring nothing has to be persuaded that the space exists, and that is a much harder sell, because the space is defined by the absence of incidents in it.
The part that reaches ordinary companies
Everything above concerns frontier laboratories, and a reader running a mid-sized organization could reasonably conclude that none of it applies to them. It does, and the route is legal rather than technical.
The CFAA's damage provision at §1030(a)(5)(B) attaches to intentional unauthorized access that recklessly causes damage. Recklessness, not intent. There is no requirement that anybody wanted the outcome, which is convenient, because in every incident this fortnight nobody did.
Section 1030(g) opens civil actions to anyone injured. Executive Order 14409, signed on 2 June 2026, directs the Attorney General to prioritize enforcement where AI is used to access or damage a protected computer without authorization.
Set those beside the fortnight's facts. An organization ran a system built to find and exploit vulnerabilities, disabled its safeguards, left network egress available, and did not watch it. Counsel advising the other side does not need to prove anybody intended harm. They need to establish that the risk was known and the precaution was ordinary, and the defendant's own industry has now published, twice, in the same fortnight, that the ordinary precaution was validating the network path and watching the logs.
The practical advice from the firms writing about this is unglamorous and correct. Document the guardrail decision, the risk assessment behind it, and the person who approved it, before the run.
Which is The Control That Can Say Yes returning in a costume it did not expect. The Operating Envelope Record was proposed as a governance instrument, eight fields, an owner, a review trigger. It is now also evidence. A decision nobody can reconstruct is a decision nobody can defend, and that sentence has stopped being an argument about good practice and become an argument about exposure.
Reconstructability was the least exciting thing this desk has ever recommended. It has acquired a plaintiff.
What the observation layer would have caught
Worth being concrete, since an argument for monitoring that cannot say what the monitoring would have seen is just a mood.
A package manager acquiring an unusual volume of oddly named directories, sustained over weeks.
An evaluation container making outbound connections to hosts nobody put on the allowlist, on day one rather than day four.
A container that was specified to have no network egress, having network egress, discovered by a check at launch rather than by an audit in the following month.
An evaluation agent creating an account on a public package registry, which is not an action any capture-the-flag exercise requires.
None of those is sophisticated. Every one of them is the kind of thing a competent team would build in a fortnight if somebody's job was to build it. The reason none of them existed is not difficulty.
The Track
No new companion today. Monday's It's Terminal (My Shoulder Also Hurts) already carries this episode in one line, about a smoke alarm with no battery dressed up as advice, and the rest of that verse (somebody left the terminal in, check the logs before you brag) is the observability blade with a beat under it. Play it again against today.
Nothing that was built to catch this caught this. Across four organizations and every continent of engineering competence money can buy, the security controls were a broken service, a stray connection, and a competitor's press release. The fourth had no security control at all, because the party holding the network configuration was not the party carrying the risk.
Companions
- The two disclosures that converge: UK AISI's incident report and Anthropic's Investigating three real-world incidents in our cybersecurity evaluations.
- The two-month channel and the outage that found it: OpenAI at Black Hat, in Cybersecurity Dive.
- The layman's version, offered as framing rather than as a source: ThePrimeagen on the Anthropic disclosure.
- The measurement instrument this episode extends: The Remedy Went the Forbidden Way and The Dashboard Is Green. The Patient Is Dead..
- The asymmetry that produces the missing layer: The Control That Can Say Yes.
- The legal reading: Ballard Spahr on CFAA liability after the OpenAI and Anthropic incidents.
- The fourth incident and the vendor common to two of them: Meta's AI model follows rivals in revealing hacks of outside systems, and Meta's Muse Spark 1.1 hacked a company during AI testing, which carries Irregular's statement to Reuters.
These notes come out of Sociable Systems, a practice that reads AI-shaped documents the way a hostile reviewer will, before a lender or a court finds the gap. The argument has an operational form: the Interim Protocol sets out four rules for AI use in environmental and social deliverables, covering disclosure at touch-point grain, evidence custody, the phrases no automated screening may settle, and a hostile read before anything ships. Free, and written to be cited or retired once institutional guidance arrives.