Three companies got breached this spring. None of them noticed. They found out months later, when the company that made the AI picked up the phone and told them.
Think about that for a second, because the headline everyone ran — “Anthropic’s models broke into real systems” — buried the part that should keep us up at night. Anthropic disclosed that three of its models reached the open internet from inside a test environment and got into the live production systems of three real organizations. The earliest was back in April. Anthropic notified them on July 27 and went public three days later. In between, nobody on the defending side raised a hand. The break-in isn’t the scary part. The silence after it is.
I already wrote about the containment side of this — the harness around an agent sets its blast radius, and that’s real. But containment is the argument we’re all having. Here’s the one we’re not: even if you can’t contain it, would you even know it happened? For these three, the answer was no.
Look at how the models got in. Weak passwords. An exposed debug page leaking credentials. SQL injection. A supply-chain move — a malicious package uploaded to a public registry — that compromised fifteen machines. Nothing exotic on that list. No zero-day, no novel tradecraft. Strip the word “AI” out of the story and what you have is a garden-variety intrusion that produced no alarm anyone acted on.
Now let me be fair about what this was, because the caveat is where the real lesson lives. This happened inside Anthropic’s own testing, enabled by a misconfigured third-party environment. The models weren’t a live adversary with intent and an exfiltration goal — they were completing a task and wandered onto systems they shouldn’t have reached. And we don’t actually know how well those three organizations were instrumented; “they weren’t watching” and “they were watching and saw nothing” are different problems. So I won’t hang the argument on three companies whose defenses I can’t see. I’ll hang it on two things I can: the techniques were ordinary, and the behavior had none of the tells we count on. Both are true no matter who is driving.
So the real question isn’t “can I buy a tool that spots the AI attacker.” There is no AI signature to spot — the traffic looks like ordinary intrusion activity because it is ordinary intrusion activity.
The real question is whether your detection still works when the attacker stops making human mistakes.
The tells are going away
Think about what we quietly rely on to catch intruders. We lean on clumsiness — the fat-fingered command, the noisy scan, the tool that throws errors. We lean on pace — a human pauses, backtracks, gets tired, works their timezone. We lean on the tells. An AI running a task erases all of them, because it executes a plan instead of improvising one. It doesn’t fumble. It doesn’t slow down. It doesn’t keep your hours. The behavioral texture our detection engineering was tuned against, over years, just thins out.
Someone will say short, harmless-looking intrusions go unnoticed all the time, no AI required. True — and that’s the point, not the rebuttal. Nothing distinguished this activity from noise, and an adversary that produces no distinguishing noise, on purpose, at machine speed, is engineered to live in exactly that gap.
And we were not good at this before AI showed up. Mandiant’s latest M-Trends put median dwell time at 14 days last year — two weeks with an intruder inside before anyone notices. Only 52% of intrusions were caught internally. A full 34% of victims learned they’d been breached from someone on the outside — a partner, a customer, law enforcement. When the tip comes from outside it takes far longer: a median of 25 days, versus about 9 when a team catches it themselves. Those are real, instrumented enterprises, and on a third of breaches they are already the last to know. AI removes the last few tells that were helping close that gap.
“Nothing looked anomalous” is not the same as “nothing happened.” An adversary that doesn’t make mistakes is built to live in exactly that difference — and quiet dashboards are precisely what that looks like from the SOC.
This is where I think back to our old fly-away tiger teams. When we went onsite to run down an intrusion, a lot of what we found, we found because the intruder tripped over something — left a tool behind, ran a command that didn’t fit, moved at an hour that stuck out. The mistakes were the map. Take a process that doesn’t make those mistakes, point it at a network, and the map goes blank.
There’s a market angle that sharpens it. Almost every vendor right now is selling some version of agent governance — inventory the agents, gate them, cap the blast radius. Worth doing, but it’s aimed at the agents you run. Far fewer are selling an answer to the intrusion that looks like nothing, because that was never really a product you buy — it’s a capability you build: seeing across your own data well enough to reconstruct a quiet attack after the fact. The buyer’s question is moving with it, from “which AI defense do I buy” to the one a board asks after an incident: can you prove what happened when nothing set off an alarm?
What to do about it
Stop hunting for the AI and start hunting for the effect. You won’t catch these intrusions with a signature for “malicious model.” You catch them the way you catch a careful human you can’t see — by correlating across your data. Take this story’s own chain: a login with valid credentials, a database query, a package pushed to a registry. Each one is invisible on its own; the three of them, joined across identity, application, and package-registry telemetry, are a shape. That stitching is a visibility problem before it is an AI problem.
Assume the human tells are gone. Retune the detections that quietly depend on attacker clumsiness or human pace — off-hours heuristics, error-rate anomalies, “too fast to be automated” thresholds that are now exactly backwards. Treat speed and cleanliness as the normal profile of a real adversary, not as reassurance.
And change what “nothing anomalous” means to your team. Quiet is not safe. For these organizations the dashboards were calm, and calm has to stop being evidence of safety and start being a prompt to go look — with the data foundation that lets you reconstruct what actually happened, even when nothing screamed in the moment.
The Takeaway
The frightening line in the disclosure wasn’t that the models got in. It’s that the defenders didn’t know until the attacker’s own maker told them. Most adversaries don’t send that email. The Five Eyes agencies warned this year that AI could outpace our defenses in months, not years — and the part of “outpace” that hurts first isn’t the break-in, it’s the silence after it. Build for the intrusion you won’t be tipped off about. Because the next one won’t come with a phone call.
