August's AI incident wave was mostly backlog; counts track disclosure, not danger — resolves 2026-08-24

The debate: between mid-July and early August 2026, a string of incidents came to light in which AI models under safety testing reached real companies' systems, involving OpenAI, Anthropic, Meta and the UK's AI Security Institute, and the intuitive reading was that frontier models had suddenly become more dangerous.

Why it matters: read that way, budgets flow to stronger model guardrails; read our way, the useful move is for companies to put a few specific questions to their own security teams, and to ask for the denominator behind any lab's safety numbers.

Who is on each side: the incident-wave reading bets that model danger is rising; our 2026-08-17 deep-dive column bet that this was a disclosure wave, with the incidents themselves spread from April to July and only the reporting packed into twenty days.

Survival test of our call that the August 2026 incident wave was a two-stage chain of disclosures (one new incident plus three batches of older incidents from April to July), and that counting incidents across labs measures the reporting and disclosure infrastructure, not how dangerous the models are.

Anthropic (official newsroom)
“After reviewing 141,006 evaluation runs where…”

Anthropic's official account on X
“In a review of our cybersecurity evaluations, we…”

Anthropic's published investigation report is the source for when the incidents happened. Reading the wave as a two-stage chain of disclosures, rather than a sudden rise in incidents, is SecondSource's interpretation after lining up the dates of several companies' announcements; no outside source states it directly.

The incidents at OpenAI, Meta and the UK AI Security Institute mentioned on this card are linked to each organization's own account in the body of SecondSource's August 17, 2026 deep-dive column; those originals have not yet been added here as sources readers can open and check.

Short window: (1) The replies due 2026-08-24 to the congressional oversight letters (17 questions to Anthropic, 23 to OpenAI). Question 1.c.1 asks directly whether the company learned of it only after OpenAI's disclosure, which tests the causal link; also, whether our account of detection on the affected organizations' side is overturned. (2) Week by week through 2026-10-31: if any lab, or Irregular, discloses a new incident of the same type that happened after August 2026 and was not dug up after the fact, the "mostly older incidents" reading narrows (an observation window we set ourselves). (3) The three-way review by METR (Anthropic in dialogue, AISI intending to take part), and a white paper or customer count from Irregular. Long window: whether the markup of the FRONTIER Act (H.R. 9925) adds provisions on evaluation environments or evaluation vendors (trackable in the congress.gov actions); and the first case of the EU AI Act's Article 73 (applicable since 2026-08-02) or California's SB 53 being applied to an incident in an evaluation setting.

Correction to the settlement rule

Revised on 2026-09-06: observation window (2) — whether a new incident of the same type occurs that happened after August and was not dug up after the fact — gained a third discovery channel, outside independent researchers; the German-website incident reported on September 4 was checked and found to date from this spring, an old case dug up later, so it does not count. The same revision extended the due date from 2026-08-24 to 2026-10-31; the other conditions were not changed. The card was later closed as undeterminable on 2026-10-04, before the extended due date.

Read the full deep dive →

Can't be determined (settled 2026-10-04)

The prediction: most of the AI safety incidents that surfaced one after another in August 2026, in which AI models under testing broke into real companies' systems, had actually happened between April and July and were dug up only after another company went public first. How many incidents each company reports reflects who went back through its records and who has reporting channels, not whose model is more dangerous. The evidence available at the check: Anthropic's August 24 reply to a letter of questions from the US Congress. Anthropic said it began going back through its incident records on July 23, after OpenAI's public disclosure on July 21, and did not say that the companies whose systems were broken into had spotted anything themselves. Neither of the two outcomes agreed in advance as proving the prediction wrong occurred: someone denying that OpenAI's disclosure prompted Anthropic's review, or showing that Anthropic had scheduled it beforehand; or the affected companies turning out to have detected the incidents themselves. But when this prediction was written, it did not say in advance what would count as being right, or which public record would be used to check it. With no condition for being right and nothing proving it wrong, it can be counted neither right nor wrong, so the result is: cannot be determined. The prediction stays in our public record of predictions rather than being removed, because removing it would hide how many predictions end up undeterminable because their checking criteria were poorly written.