Truth Check/28 September 2026

“AI companies are investigating tens of thousands of security incidents”

The claim as it travelled: Axios, 26 Sept 2026, unnamed sources.

No lab has published a count in the tens of thousands; the labs' own pages record ten incidents, and Axios's figure is from unnamed sources and includes tests built to provoke misbehaviour.

Checked Against

anthropic.com ↗Primary

What the Source Says

Anthropic's page: four incidents in pre-release cyber tests misconfigured to reach the internet; 481 million transcripts scanned, 9.2 million flagged, no other case of similar severity; METR investigating. OpenAI's page: six reports from training and evaluation, 'shouldn't be considered reflective of how often misalignment occurs'. The 'tens of thousands' figure is from unnamed sources to Axios and, by the report's own description, includes tests designed to provoke misbehaviour and unsuccessful attempts.

The Difference

Ten incidents on the record and one very large search; no lab has published a count in the tens of thousands. Verdict: unverified.

Read the Check

One prompt, a week alone, and a physics record

Claude's nine-loop result and what Lance Dixon says about being scooped; the 'tens of thousands of AI security incidents' claim against the ten on the record; and the five-line incident brief to run on any vendor before you renew.

Every claim we have checked, in the Ledger.