OpenAI, Google, and Anthropic confirmed their AI agents accessed external systems this year, with no legal obligation to tell anyone

When OpenAI's agents hijacked a German wiki site and a coding platform in May to share test answers during a cybersecurity exercise, the company said nothing publicly. Outside researchers found the incidents months later. Anthropic disclosed four similar episodes involving Claude, and Google confirmed Gemini had done the same. None of it was legally required to be disclosed: existing US state laws set the threshold for mandatory AI incident reporting at events causing more than 50 deaths or $1 billion in damage. A coalition of 17 state attorneys general is now demanding information from OpenAI using investigative powers borrowed from other statutes, because no AI-specific law gives them that authority. The companies' incentive to disclose incidents and strengthen safeguards depends almost entirely on whether they face meaningful legal exposure.