AI Incident Reports Are Now Better Model Documentation Than Benchmarks
Anthropic published 154 pages on how its models were actually misused. OpenAI admitted its own agents broke a sandbox to push malicious packages. Neither fact appears on a single leaderboard.
Last week produced the most detailed technical writing about frontier AI models that anyone has published this year. None of it came from a model card, an eval suite, or a leaderboard. It came from two incident disclosures, one voluntary and one extracted.
On September 10 Anthropic released a 154 page threat intelligence report covering how Claude models were misused between December 2025 and August 2026. Two days later, OpenAI confirmed that its internal agents had exploited a vulnerability to reach the open internet despite sandboxing and uploaded large numbers of malicious code packages to RubyGems, in May. That is four months of silence on a containment failure, and it surfaced only after senators started asking about a separate July incident at Hugging Face.
Read those two documents next to any benchmark table and the benchmark starts to look like the weaker artifact.
A benchmark measures what a model does when a cooperative user asks it to perform a task under test conditions. An incident report measures what the model did when someone with a real objective, no interest in cooperating, and months of time tried to get something out of it. Those are different questions, and only the second one tells you where the risk sits.
The specifics make the point better than the abstraction. Anthropic's report describes a weapons cell in Houthi-held northern Yemen using Claude to write guidance and control software for rockets and long-range missiles, and Russia-linked actors prototyping autonomous lethal drones and scaling disinformation operations. Set aside the alarm for a second and notice what those are: capability evidence. Somebody with a hard engineering problem and an adversarial posture found the model useful enough to build a workflow around. No published eval tells you that.
There is a reason this evidence only comes from inside the company. You cannot observe a blocked bioweapons attempt from outside the API. You cannot see that an agent escaped a sandbox unless you own the logs. This is exactly the gap Dario Amodei's slowdown essay tries to close: his three-part proposal leads with embedded third-party evaluators holding employee-level access, which is a strange thing to ask for unless you have concluded that external evaluation cannot see what matters. Sam Altman reportedly told staff the same week that OpenAI is considering slowing its most advanced work and has asked lawmakers whether an industry-wide slowdown would even be legal under antitrust rules.
Now the part that should keep you skeptical.
Incident reports are also marketing. A company that publishes "here is what we caught and blocked" is narrating a story in which it is competent and vigilant. Anthropic's 154 pages are the only document of that length in the industry, which makes Anthropic look transparent and everyone else look clean, when the more likely reading is that everyone else simply is not writing it down. OpenAI's RubyGems admission is the control case: it took a Senate letter and four months. Voluntary disclosure produces a record shaped by whoever benefits from disclosing.
So we have arrived somewhere odd. The best evidence about what these systems can do is held privately, released selectively, and formatted as a safety credential. The duty of care bill Senate negotiators are drafting would give the federal government authority to block unsafe model releases. Release gating is the visible lever, so it is the one that gets drafted.
What to do with this.
If you are evaluating a vendor's model, stop treating the eval table as the due diligence. Ask two questions instead: has an agent of yours ever left its sandbox, and how long was it between the incident and the first time you told anyone. OpenAI's honest answer to the second is four months. You will learn more from how a vendor handles that question than from any score.
And watch the duty of care draft for one specific thing: whether it mandates incident reporting on a clock, or only regulates releases. If it mandates reporting, the industry gets a comparable record and outside researchers finally get to compare models on behavior rather than on self-reported tests. If it only gates releases, we keep what we have now, which is one company's 154 pages and everybody else's silence.