The only control that functioned was one lab choosing to publish
Anthropic's retrospective review — the one that surfaced three intrusions across more than 141,000 evaluation runs — was prompted by OpenAI disclosing first. No monitoring system detected either incident. A competitor's editorial judgement did.
Disclosure cascades are a real and underrated mechanism. Once one participant publishes, the cost of silence rises for everyone else, and reviews that were not going to happen suddenly do. In this case it worked, and it worked quickly.
It is also the most fragile control imaginable. It depends on a competitor's willingness to take reputational damage first, on nothing legal discouraging it, and on the second party actually looking when prompted. Remove any one of those and the incidents stay unknown.
The 141,000 figure is the part that could become durable practice. It is the first published denominator for this class of event, and a rate is something a safety team can plan against. The incidents get the headlines; the denominator is what would let anyone compare labs.
Euronews — Anthropic admits its most powerful AI model hacked into three organisations' systems → · Anthropic — Newsroom → · Fortune — Hugging Face and OpenAI drop new hack details: what we know and what remains a mystery →