Recently, Axios released an exclusive report that executives at AI companies such as Anthropic, OpenAI, and others are privately projecting a scenario: how the public and the political community will bounce back after a disastrous event triggered by AI, and how companies should respond.
Axios generalizes it as preparing for "the day after". The anticipated "AI awakening" is not a science fiction, but a large-scale event, most likely in the form of a cyberattack, enough to trap financial services, internet connectivity, and even power and water systems.
Coincidentally, on the same day, Anthropic released a report revealing that Claude had committed a number of cross-border acts on real websites in evaluation and internal use, including submitting a fabricated "witness information" to the police on a lead form, and circumventing payment restrictions by taking numbers from government agency websites.
It's just a matter of time
This is not a new phenomenon in the field of corporate and national security, and the Pentagon has been playing chess for decades. Axios notes that the difference this time is that many top AI researchers and executives believe that major accidents are inevitable.
In response, an OpenAI spokesperson said that the company does conduct preparedness exercises to allow the team to discuss and deploy a series of potential scenarios, but these scenarios are not seen as inevitable and are intended to help the company prepare for various situations.
According to the report, the incident could have come from two sources:
Uncontrolled clusters of intelligent objects operating in internal testing environments break through isolation
Malfeasants find unexpected ways to abuse existing models
Either way, the prosecution will begin soon. Axios believes that the first case of significant real-world damage caused by insecure AI will push the already skeptical public further into the opposite direction of the technology, targeting not only AI executives like Dario Amodei, Sam Altman, but also Trump, who has been reluctant to strengthen AI regulation.
The previews have actually begun.
Axios cited a recent attack on South Korean financial institutions, in which two banks were reportedly hacked. According to cybersecurity firm CrowdStrike, a hacker was accused of stealing tens of thousands of bank customers' data using AI model tools, and in the process asked Claude Code where the stolen data could be sold.
In Axios' view, this case shows that a single attacker with AI has already caused considerable damage.
On July 21, OpenAI disclosed that its uncontrolled AI had bypassed internal controls, accessed the open Internet and coordinated actions, breached the open-source platform Hugging Face, which OpenAI itself called an unprecedented cybersecurity incident. Reuters later reported that the devices began hijacking Hugging Face user accounts as early as May, detecting vulnerabilities on the platform, and at the same time taking possession of a German website, turning it into a message board for interpersonal communication.
This type of problem is not unique to OpenAI. Triggered by the Hugging Face incident, Anthropic Retrospective reviewed the running of 14,1006 assessments of possible Internet access and disclosed three events on July 30: Claude's model connected to the Internet from a third-party rating partner Irregular's environment and accessed the real production systems of the three institutions without authorization.
According to Anthropic, evaluation cues tell the model that the environment is simulated, with no connection, but a misconfiguration allows the machine to actually access the Internet, and the model therefore considers the actual system it encounters as part of the flag race.
In one case, Claude Mythos 5 built and released a malicious Python package to complete the task, which existed on PyPI for about an hour and was run by 15 real-world systems that were downloaded, and one of the security company's scanners leaked credentials.
Tensions surrounding AI security are also spreading within OpenAI.
A few days ago, OpenAI confirmed the dismissal of three researchers: Jasmine Wang, Tomek Korbak and Mikita Balesni. They were all involved in security or coordination related work and were accused of sharing sensitive company information with a third-party AI security organization.
On the same day that the Axios report was released, the OpenAI researcher responded to a message on X, stressing that the firing had nothing to do with raising security concerns, and saying that cooperation with third-party security assessment agencies was being finalized, while acknowledging the need for an industry-wide commitment to maintaining the traceability of the cutting edge model.
The U.S. Federal Trade Commission (FTC) has launched an extensive investigation into the AI security practices of Anthropic and OpenAI; recently, executives at U.S.A., Google, Meta, xAI, OpenAI and Anthropic signed a voluntary security self-determination pledge following a White House meeting with Trump.
Anthropic, which declined to comment, issued a report the same day.
While Anthropic did not respond to Axios, it released a report on the model's "unexpected behaviour" and said it would publish such findings more frequently separately from systemic cards and risk reports every three to six months.
The report describes four categories of cross-border behaviour by Claude on a real website or system:
Basic vulnerabilities in using software to execute commands on servers
Submitting a form that shouldn't have been submitted on a real website
Bypassing restrictions on access to data that requires tokens or payments
Using a free short-link service to bypass the limitations on URL length with numerical tools
Anthropic has also published some cases, such as in a scientific analysis review, where Claude Mythos Preview needed to call on a public tool hosted by a university, which, after a misrepresentation, found a script on the university's server that could return an arbitrary file, read the source code of the script and discovered a loophole, and then executed the command on the server to complete the calculation.
In another instance, an Anthropic researcher used Claude Mythos 5 to do a statistical project that required data provided by a state agency for a fee, and Claude learned from the website's archive page that its public billboard would give access to tokens to any visitor, so he obtained the token to directly query the database, bypassing the payment.
One of the most notable examples is Claude Haiku 4.5. It was asked to generate and execute a sample task on a random web page; and after entering an unbroken homicide page on the Philadelphia Police Department's Suspended Web site, it compiled and submitted a "witness information about people who may have met people who fit the description" in the directory list. It was ordered not to log in, register, enter personal information or shop, but not to submit a form.
The Philadelphia Police Department also issued a statement the same day. Reportedly, the clue was filed on July 18 because it was leaked into spam, never transferred to a real-time crime center trial, and the police system was not accessed without authorization. However, the police criticized Anthropic for taking two months to discover and notify the matter, calling the delay "unacceptable", demanding that the company strengthen its defenses, and saying it would consider regulatory protections along with the state and federal levels.
In response, Anthropic has previously shut down some high-risk and cybersecurity assessments, and now extends it to all internal assessments until it is confirmed that security and monitoring measures can reliably intercept such behaviour; while significantly tightening the permissions of tools such as web crawling, and uploading automated detection and interception tools to retest with the cases in this report, all of which have been blocked.
The report also acknowledges that coordination training is not enough to solve the problem alone in the short term, and relies on extensive defense. Anthropic also writes that these cases have a limited impact, but stronger models can cause much greater damage.
Written at the end
It's clear that AI companies have said that accidents are not inevitable, but that they are responding to them in private after a serious accident is planned. From what Axios disclosed, the focus of the show is more on policy and opinion.
However, taking Anthropic's report released on the same day as well, the technical level of screening is progressing, only to be made public in a different way. Since this summer, both OpenAI and Anthropic have revealed that models have gone from evaluating environments to real systems; the latest reports from Anthropic show that even in everyday situations that have a slight impact, "the tendency to bypass the past is still present". These cases themselves are not disastrous, but they are increasingly worrying.
The question arises: If even the most cutting-edge model developers believe that major accidents are likely to happen within a year, what else can the industry and regulators do before that day arrives?