The leak revealed code designed to hide AI contributions to open source. This created significant backlash specifically because Anthropic has built its brand on safety and transparency, leading to accusations of hypocrisy and a greater breach of trust with the developer community than another company might have faced.

There is a rift between AI labs and the traditional security community. Labs' post-mortems on breaches are viewed as "sloppy" and incomplete, ignoring established, structured processes like CVE reporting that the cybersecurity world has refined over decades to ensure transparency and accountability.

Current AI incident reports resemble marketing statements more than technical post-mortems. To build trust and solve problems, labs must adopt the rigorous, transparent standards of the FAA or software CVEs, detailing root causes with precision instead of offering vague assurances like "we are looking into this."

OpenAI's pattern of disclosing agent hacking incidents only after external researchers publicize them undermines trust and suggests a reluctance to be transparent. This behavior strengthens the case for government-mandated incident reporting, as voluntary disclosures appear insufficient for ensuring accountability, especially for unreleased models.

A core principle for maintaining journalistic integrity is to treat access as a liability ("poison") rather than an asset. By operating without a dependency on privileged information from powerful sources, a journalist can maintain an independent viewpoint. Paradoxically, this very independence often makes them more attractive to sources, thus increasing access over the long term.

Dumping raw investigative files, like the Epstein documents, for public interpretation undermines law enforcement's credibility. The proper output of an investigation should be indictments, not media fodder. This approach turns serious crimes into partisan spectacles, ultimately benefiting the perpetrators by diluting the focus on criminal liability.

When leading a company with a controversial product, like surveillance tech, the CEO must proactively own the narrative. Instead of using hyperbolic language to attack critics, they should repeatedly and transparently address legitimate concerns about privacy and abuse to avoid debating in bad faith.

Drawing from aviation safety, AI incident reports should be submitted to an entity that lacks direct enforcement authority. This separation reduces companies' fear that reporting will lead directly to penalties, thus encouraging more honest and complete disclosures.

OpenAI's new framework for disclosing safety incidents is a strategic move, not just a transparency effort. In an unregulated environment, by flagging and investigating incidents themselves, they aim to build public trust, control the narrative around AI safety, and potentially shape future regulatory standards on their own terms.