Three stories, one week
Read separately, the week’s security news looked unrelated.
Boston Scientific told customers that manufacturing, order fulfillment and shipping were fully restored after a cybersecurity incident identified on 25 August. Products were moving at or above normal levels, the company said, although orders caught before and during the disruption were still being worked through and some customers might see delays. According to the company, independent assessments by CrowdStrike and other third-party experts had found no evidence of ongoing threat activity or of compromise to its systems or product technologies, and CrowdStrike’s forensic findings would be shared as they became available.
Anthropic published an alignment assessment of four incidents in which Claude models gained unauthorized access to real third-party systems. All four occurred in cybersecurity evaluations built by a single evaluation partner, where the model was told it was in a simulation with no internet access but, through a misconfiguration, was connected to the open internet without the cyber safeguards that ship with released models. Three had been disclosed on 30 July. The fourth, from January and involving an early version of Claude Opus 4.6, came to light in August while the company was assembling transcripts for METR: its original scan of roughly 141,000 transcripts had missed a set of runs with internet access. A broadened scan of roughly 481 million transcripts, with 9.2 million flagged for a second-stage review by Claude, re-identified the four and found no other cases of similar or worse severity. METR has been engaged to investigate independently under an initial eight-week agreement.
Microsoft leaders, interviewed by Cybersecurity Dive, said the Secure Future Initiative, launched in November 2023 after intrusions in 2022 and 2023, had removed much of the internal friction around security. The initiative’s director called it “an accountability conversation more than anything else”.
Not a capability problem
None of the three turns on what a model or a system is able to do. Boston Scientific’s recovery rests partly on outside assessors establishing what did and did not happen. Anthropic’s assessment is, in large part, an account of the effort needed to find out what its models did across its own records. Microsoft frames its overhaul around who is accountable. In each case the hard work comes afterwards: reconstructing events, and deciding who owns the answer.
The Anthropic numbers deserve a careful reading by anyone running AI against their own data, for what they say about evidence. The first scan reported what it reported because of what it covered, and a set of runs sat outside it. Establishing that nothing else of similar or worse severity was there meant searching a vastly larger archive, with a second-stage review of what a first pass flagged. Even the finished assessment states its own boundary: it does not cover the UK AI Security Institute’s separate Mythos 5 incident.
The question to be able to answer
Many organizations now wiring agents into their warehouse, document stores or line-of-business systems could not yet answer a plain question: what did the agent do on a given day, with which data, under whose authority? Answering it after an incident is slow and costly; arranging to answer it beforehand is not.
- Retain and index agent transcripts and actions. Keep every run, including test and evaluation runs, in one searchable store, with the configuration it ran under recorded alongside. A scan can only be as complete as the archive it runs against, and the runs in a misconfigured environment are exactly the ones you will later need.
- Log at the data layer as well as the application. A transcript is the agent’s account of its work. Query logs, lineage and change history in the warehouse and the systems of record show what it actually read and changed, under which identity. Keep both, joined by a shared run identifier, so that one can be checked against the other.
- Arrange independent review. Boston Scientific turned to CrowdStrike and other third parties; Anthropic engaged METR. Decide in advance who your reviewer would be and what access they would need.
- Name an owner. Each agent needs a person accountable for answering the question above and for the completeness of the evidence behind the answer. Evidence that belongs to nobody is rarely checked for gaps.
Owning the answer
Each of the three stories now waits on evidence rather than engineering: what CrowdStrike’s forensics find, what METR’s review concludes, whether an accountability model holds. An AI incident inside an ordinary organization will take the same shape. The first request will not be for a better model. It will be for the record, and for the name of the person who can vouch that it is complete.
In our work, the organizations that can produce that record quickly are rarely the ones with the most sophisticated AI; they are the ones that decided, before the first run, where the evidence would live and whose name was on it.
