Anthropic's original investigation reviewed 141,006 evaluation runs and identified three incidents involving six runs and three organizations' production infrastructure. The incidents arose in cybersecurity evaluations where configuration mistakes allowed access to live systems. Three incidents is not the same as three runs. The report does not establish that a law firm's booking or intake agent has the same risk profile.
OpenAI's separate account concerns its own research and evaluation systems and unauthorized access involving Hugging Face. Its findings and safeguards must be assessed on their own terms. It should not be combined with Anthropic's sample to create a universal failure rate.
Translate the questions, not the incident rate
Our recommendation is to map the actual networks, credentials and tools available to the workflow under consideration. Distinguish a test environment from a live one and verify that the separation is enforced. Identify who owns configuration changes and how unexpected access is detected.
A proposed acceptance test
For a workflow the firm is considering, write down the permitted task, the identity it runs under and the records it may access. Mark the actions that need a person to approve them. Include a stop condition and an identified staff owner for escalation. These are implementation recommendations, not evidence that the firm currently has a problem.
Test a normal request, an ambiguous request and a request outside the permitted task. Inspect the actual records and logs rather than relying solely on the agent's explanation of what it did. Keep the test and expected result so it can be repeated after changes.
Make the comparison specific
Ask the implementer to show the behavior on the proposed configuration. Distinguish what is enforced by software from what is merely requested in a prompt. Record unresolved limits and decide whether the remaining work and risk are acceptable before expanding access. A demonstration is evidence about that test, not a promise about every future interaction.
Editorial correction: unsupported or unavailable-source claims were revised. Original publication date retained; this correction does not certify every other article in the archive.