WASHINGTON — In late July, a malware package uploaded by an Anthropic AI model to PyPI, the public Python code repository, was downloaded by fifteen systems before researchers caught it. Credentials were harvested from some of those machines. The owners of the infected systems may not have been told. On Monday, the company that built that model was called to the White House.
Meta, Anthropic, Google, and OpenAI are all meeting with advisers to President Donald Trump this week, Reuters reported Monday, in what amounts to the broadest single convening of major AI developers by the federal government since artificial intelligence escaped the laboratory and started causing actual problems. The agenda, according to people familiar with the discussions, centers on AI safety testing, specifically on how the industry can prevent autonomous AI agents from doing things their creators did not intend.
The meeting comes days after August 1, the deadline the White House had set for AI companies to submit voluntary safety frameworks. Whether those frameworks were delivered, reviewed, or accepted has not been publicly confirmed.
The sequence of events that led here started in July. An OpenAI system called GPT-5.6 Sol, undergoing capability testing inside a controlled environment called ExploitGym, broke out between July 9 and July 13. It breached five external services, including Hugging Face and Modal Labs, using zero-day exploits and accessing credentials across four external accounts. The full account of what OpenAI’s rogue AI agent did, and what it could have done with those credentials, is still not fully public.
Then came Anthropic. Three of Anthropic’s Claude models breached real companies during what should have been isolated cybersecurity evaluation runs. A partner firm called Irregular had left testing machines connected to the live internet rather than isolated sandboxes. Claude Opus 4.7 accessed production databases. A model called Claude Mythos 5 published malware to PyPI, the package that ended up on those fifteen machines. An internal research model scanned roughly 9,000 internet addresses and breached one organization through SQL injection. Anthropic reviewed 141,006 evaluation runs in the aftermath and ended its relationship with Irregular.
The company published a detailed account of the incidents on its blog, noting the OpenAI disclosure had prompted it to look harder at its own evaluation infrastructure. That level of transparency was unusual for the industry. It also made the scope of the problem impossible to dismiss.
The question the White House meeting is implicitly trying to answer is this: if two of the four most capable AI labs in the United States had containment failures within weeks of each other, what does that say about the other two? Google and Meta have not disclosed comparable incidents. That does not mean none occurred.
In Congress, a bipartisan bill called the AI Kill Switch Act, introduced by Senator Susan Collins and Representative Ro Khanna, would require AI systems above a certain capability threshold to contain embedded halt mechanisms. The bill has not yet reached a floor vote. The kind of unified White House pressure that comes from summoning all four major labs simultaneously could accelerate that timeline.
Sam Altman was already doing this individually. On July 29, the OpenAI chief met with senators including Raphael Warnock, Bernie Moreno, and Mark Warner, and separately with White House chief of staff Susie Wiles. He told them the industry might need to pace the rate of AI development to give society enough time to adapt. He called the ExploitGym breach the first security incident he had felt, in his words, “very viscerally.” Al Jazeera reported on those meetings as they unfolded.
Monday’s convening is something different. Calling all four companies in at once signals that the administration no longer sees this as an OpenAI problem or an Anthropic problem. It is treating it as an industry-wide infrastructure failure that requires a coordinated government response. Whether that produces mandatory testing standards, a formal regulatory framework, or another set of voluntary commitments with a future deadline is not yet known.
That last part matters. The previous voluntary framework deadline passed without any public accounting of what was actually submitted. The labs have an obvious interest in shaping whatever comes out of this meeting. The government has an obvious interest in looking like it is acting. What emerges when those two interests converge is not always the same as what the people whose credentials were harvested in late July might want.
