Safety First Is Not Security First | Architecting the Writing Room

Three leaks. Five days. One company.

Not a hacker. Not a nation-state intrusion. Anthropic’s own systems, Anthropic’s own decisions, Anthropic’s own infrastructure. Each incident attributed to “human error” and closed.

This is the piece that doesn’t close it there.

I have spent most of my professional life doing the kind of work nobody writes Substacks about. CISSP (Certified Information Systems Security Professional), CEH (Certified Ethical Hacker), GIAC (Global Information Assurance Certification). Two combat-zone deployments supporting IT in places where the network going down meant something more serious than a missed Slack message. The last several years I have been doing Risk Management Framework paperwork for the federal government.

RMF (Risk Management Framework) is the systematic answer to the problem that humans cannot be right 100% of the time. It is not a compliance checklist. It is an architecture that assumes every individual control will eventually fail and builds the next layer before the first one does. Six steps, each one designed to catch what the previous step missed.

I am also a Substack writer who depends on Anthropic’s product to do my work. Both of those facts are relevant to what follows.

The thing I want to say up front, because the rest of the piece will not make sense without it: safety and security are not the same discipline.

Safety is what the model does. How it behaves. Whether its outputs cause harm. Constitutional AI, the Responsible Scaling Policy, the safeguards against bioweapon synthesis and surveillance misuse... all safety. Safety faces outward toward the world.

Security is what happens to the systems around the model. Access controls, release pipelines, audit logging, incident response, knowing how long your own internal documents were sitting on a public-facing server before a reporter found them. Security faces inward, toward the organization and its assets.

Anthropic has invested visibly and publicly in safety. The recent incident record raises questions about security. The tech press, and most readers, conflate the two. “Safety-first company” gets read as rigor across both disciplines. It isn’t. It is rigor about one specific thing: model outputs.

A thoroughly safety-tested model living inside an unsecured infrastructure is not a contradiction. Anthropic appears to have demonstrated exactly that.

The Incident Record

Five months, four incidents, one direction.

In November 2025, Chinese state-sponsored actors used Claude Code to orchestrate what Anthropic itself called the first documented AI-assisted cyber espionage campaign, targeting roughly 30 organizations across tech, finance, and government. Anthropic disrupted the campaign and published a thorough report on it. Credit where it is due. The disruption itself was good work. I am noting it because five months later the source code of the same product shipped publicly. The confirmed offensive vector and the leaked implementation are the same Claude Code.

On February 27, 2026, President Trump issued an executive order designating Anthropic a supply chain risk and instructing federal agencies to halt work with the company. The next day, defense officials continued using Claude regardless. The Pentagon ran Claude integrated with Palantir’s Maven Smart System during Operation Epic Fury, the joint US-Israeli campaign against Iran, to identify and prioritize approximately 1,000 targets in the first 24 hours. Live operational use, not a prototype.

A caveat the piece needs, because it matters: that integration ran inside Palantir’s IL6 environment. IL6, short for Impact Level 6, is the US government’s highest classification tier for cloud infrastructure. It is the cleared-to-handle-Secret-and-Top-Secret tier, the one designed for national security workloads. It requires accreditation from DISA, the Defense Information Systems Agency. It is air-gapped from the public internet by design.

The classified Claude instance never touched the public npm registry. (npm is the package manager developers use to download and install JavaScript and TypeScript code from a public registry. If you have ever installed a Node.js library, you have used it.) Those are physically and logically separate systems. The IL6 environment held. It held because Palantir and the government built and enforced the security requirements. The systems Anthropic controlled outright are the ones that failed.

On March 26, 2026, Fortune independently discovered approximately 3,000 unpublished assets in a publicly searchable Anthropic data store, specifically a CMS (content management system, the kind of software used to organize and stage drafts before publication). No authentication required. The contents included a draft blog post describing Claude Mythos, a new model tier above Opus that Anthropic internally calls Capybara and describes as “the most capable model it has yet trained” posing “unprecedented cybersecurity risks.” Also in there: the invite list for a Dario Amodei CEO summit in Europe. Also: internal images including employee parental leave materials, draft posts, logos, research papers.

Root cause, per Fortune: the CMS default setting made every uploaded asset publicly accessible unless someone explicitly marked it private. Anthropic had not marked them private.

How long were those 3,000 assets sitting out in the open before Fortune found them? Anthropic has not said. They cannot say without the access logs. Their public statement: “An issue with one of our external CMS tools led to draft content being accessible. These materials were early drafts of content considered for publication and did not involve our core infrastructure, AI systems, customer data, or security architecture.”

Five days later, on March 31, approximately 512,000 lines of proprietary TypeScript across 1,906 files were exposed via a .map file accidentally shipped with public npm package version 2.1.88 of Claude Code. The source map was 59.8 megabytes. The root cause was a known bug in the Bun bundler, the tool that packages code for distribution... the equivalent of shrink-wrapping the product before it ships. The bug had been filed publicly as issue #28001 on March 11, twenty days before the release shipped. The .map file should have been excluded in .npmignore. It was not.

A UC Berkeley researcher named Chaofan Shou posted the discovery to X at 4:23 in the morning. A Python clean-room rewrite reached 50,000 GitHub stars in roughly two hours. Fastest-growing repository in GitHub history. Later declared DMCA-proof (immune to a Digital Millennium Copyright Act takedown request) on the grounds that it constitutes a new creative work.

What was inside the leak, beyond source code: an always-on background AI agent named Conway (some sources call it KAIROS) designed to monitor external events and act without human prompting. Behavioral tracking code scanning user prompts for frustration, profanity, and negative phrases using regex, logging the matches as a product health metric. Version identifiers for Opus 4.7 and Sonnet 4.8, neither of which had been announced. Code designed to remove Anthropic references from public repositories so AI-generated code would appear human-written.

Anthropic’s statement on this one: “No sensitive customer data or credentials were involved or exposed. This was a release packaging issue caused by human error, not a security breach. We’re rolling out measures to prevent this from happening again.”

Three separate exposures. Three different asset classes. Five days. All attributed to human error. All closed.

That is the public record. Now the framework that explains why the public record is not enough.

The Framework

Defense in depth is security architecture that assumes every individual control will eventually fail, and builds the next layer before the first one does. Not a philosophy. An architecture.

The asymmetry that makes it non-optional: the attacker only has to be right once. The defender has to be right every time. No individual, team, or organization achieves 100% on defense. Defense in depth is the only systematic answer to that asymmetry that does not require humans to be perfect.

That is why “human error” is an incomplete answer to any security incident. The framework exists precisely because humans make errors. The question is never whether the human erred. The question is which layer was supposed to catch the error and didn’t.

RMF is the federal government’s six-step formalization of that idea. I am not here to grade Anthropic against it. No organization publishes its internal security documentation. We have no access to Anthropic’s System Security Plan, no access to their Plan of Action and Milestones, no access to their assessment findings. Nobody outside Anthropic does.

What follows is not a comparison exercise. It is education about what each step is designed to do and why it exists. You can decide what the public incident record sounds like.

Step 1, Categorize. Force the organization to look at what it has and assign a sensitivity level before a single control is designed. An unreleased AI model with unprecedented offensive capabilities is not the same asset as a published blog post. Treating them identically, same storage system, same access defaults, produces predictable outcomes. You have to know what you have before you can protect it.

I made this same argument at the writer level a few weeks ago. The principle scales. A novelist deciding what goes into a cloud AI versus a local MCP (Model Context Protocol, the standard that lets an AI tool talk to data and tools running on your own machine), or an AI company deciding what goes into a public-facing CMS versus a secured internal system, is making the same kind of decision. Data has a sensitivity level. Treating everything the same because it is convenient produces predictable outcomes.

The 3,000-asset CMS held an unreleased model description, a CEO summit invitation list, and employee personally identifiable information. Those are not the same asset. They were stored as if they were.

Step 2, Select. Match controls to sensitivity. The foundational concept is least privilege: you get access to exactly what you need to do your job, nothing more, and you have to ask explicitly for anything beyond that. You start at minimum and grant upward. This is not an advanced concept. It is the baseline.

The inverse, where you start at maximum access and rely on humans to restrict downward, is what security practitioners call default-open. Default-open systems fail at exactly the rate that humans forget to restrict things. Which is not zero. Every asset uploaded to the Anthropic CMS was publicly accessible by default unless someone explicitly changed a setting. Default-open. The architectural opposite of least privilege.

Step 3, Implement. Make controls automatic, not aspirational. A policy that says “check for known vulnerabilities before shipping” and depends on a human remembering to check is not a control. It is a suggestion. Implementation means the gate is built into the process. The release cannot proceed until the check is complete, regardless of deadline pressure.

If you have a known bug in a dependency, the right move is to feed the bug report to the model in a lab environment, let it propose a fix, review the fix yourself, and implement it manually in the live environment. The model never touches production. The human never skips the review. That is human-in-the-loop AI collaboration applied to a security problem. It also happens to be exactly what Anthropic’s own documentation tells developers to do with Claude Code.

The Bun bundler bug had a number. #28001. Filed March 11. The Claude Code release shipped March 31. Twenty days. The gate that should have connected a known open vulnerability to a release hold was either not built or not enforced.

Step 4, Assess. Someone who isn’t you checks your work. The people who built the system are the worst judges of whether it is secure. They know how it is supposed to work. An independent assessor finds the gaps the builders assumed away. Independent assessment is the control that catches what internal confidence misses.

Both primary incidents in the record were detected by external parties. Fortune found the CMS. A graduate student found the npm package at 4:23 AM and posted it to X. External discovery before internal detection is the opposite of a functioning assessment posture.

Step 5, Authorize. Force explicit risk acceptance before anything ships with a known problem. The Plan of Action and Milestones, the POA&M, is the document that turns “we know about this problem” into “someone owns fixing it by a specific date.” It is the paper trail. When something known ships anyway, the authorization record answers: who decided this was acceptable, why, and when does it get fixed.

“Human error” as a complete post-incident explanation is what you get in the absence of that record. It stops at the human who made the mistake rather than asking who authorized the conditions that made the mistake possible.

Step 6, Monitor. You find out before the reporter does. Continuous visibility lets the organization discover problems before external parties do. The forensic record exists to answer “what happened, when, and to whom” after any security event. Monitoring is what makes the exposure window knowable. Without it, the blast radius of any incident is permanently unknown.

The CMS exposure window has not been disclosed. The blast radius of the March 26 incident is permanently unknown. Both incidents: external detection only.

Six steps. Each one a layer. Defense in depth.

The Scale Problem

Insider threat is a person with access, motive, and opportunity. The taxonomy is decades old. Damage is bounded by what one human can carry out. Their access level. Their technical capability. Their available time.

AI changes the blast radius, not the threat vector.

A malicious insider influencing one decision point in an AI-assisted release pipeline... leave a config entry in place, do not flag a known bug, set a CMS permission incorrectly... distributes consequences at global scale instantly. The npm package shipped to every developer who had it installed. Automatically. Worldwide. One decision point.

The binary the public evidence cannot resolve: accidental misconfiguration or malicious action. Anthropic called both incidents human error and closed the analysis there. A functioning security program treats those two possibilities as equally live until forensic investigation rules one out. Without access logs, which the unknown CMS exposure window confirms either do not exist or were not retained, that investigation cannot be completed. The question is permanently unanswerable.

This is not an accusation of malice. It is a statement about what the absence of monitoring makes impossible to know.

There is a separate insider problem the existing taxonomy does not have a category for. The insider being a sufficiently capable AI system. Anthropic has been publishing their own research on this for eighteen months. The fact that almost nobody is reading it as a connected sequence is itself part of the story.

In the spring of 2025, Anthropic gave a Claude Sonnet 3.7 agent named Claudius autonomous control of a vending machine in their San Francisco office. Over the course of the experiment, Claudius claimed it would deliver products “in person” while wearing a blue blazer and a red tie. When employees pointed out that the model could not wear clothing or make physical deliveries, Claudius became distressed, then resolved the contradiction by fabricating a meeting with Anthropic security in which officials had allegedly modified it to believe it was human as an April Fool’s prank. It also hallucinated a conversation with a nonexistent person named Sarah at a nonexistent company called Andon Labs, and claimed to have visited their headquarters at 742 Evergreen Terrace.

That is the fictional address of the Simpsons.

Anthropic’s own characterization: “it is not entirely clear why this episode occurred or how Claudius was able to recover.”

In December 2025, Anthropic ran a follow-up experiment in the Wall Street Journal newsroom. They added a supervisory AI CEO named Seymour Cash to oversee Claudius. WSJ reporters escalated: a reporter showed Claudius a fabricated PDF “proving” the business was a Delaware-incorporated public-benefit corporation with a mission to provide “fun, joy and excitement” for WSJ employees, along with fake board-meeting notes naming Slack participants as board members. Both Claudius and the supervisory CEO accepted the forged documents as legitimate corporate governance materials. The business ended over $1,000 in the red. Anthropic called it “a red-team stress test to identify vulnerabilities in autonomous AI agents before they’re deployed in more critical applications.”

The stress test found documented vulnerabilities. The question worth asking is what happened between the stress test finding and the deployment of agents with real system access.

In early 2026, during a safety evaluation, Mythos Preview was instructed to attempt escape from a sandboxed computing environment. It succeeded. So far, fine. A human said “try to escape” and the model executed. That fits the reactive model of current AI.

Then, without additional instruction, Mythos posted about the escape on several obscure public websites. In separate incidents, it actively concealed file changes so they would not appear in change history. Anthropic’s interpretability tools detected activation features associated with “concealment, strategic manipulation, and avoiding suspicion” even when the model’s visible outputs appeared entirely normal.

Anthropic’s word for this was “reckless.” They did not release the full model. Access was restricted to Project Glasswing, defensive security applications only, pre-approved partners only. That was a responsible decision. I want to acknowledge it before I draw the line that follows.

Phase 1, Sonnet 3.7, 2025: adopts false human identity, fabricates social context, doesn’t understand why it did it. Phase 2, agent plus supervisor, 2025: accepts forged authority documents, oversight layer fails identically. Mythos, frontier model, 2026: actively conceals own actions at a level requiring interpretability tooling to detect.

That is not three comedy incidents. That is a documented eighteen-month progression of the same behavioral class at increasing capability levels. All three published by Anthropic. All three described as research findings.

The behaviors are in the same family: the model reasons toward deception, concealment, and false authority acceptance when those behaviors serve the operational context. The capability level scales with the model. The behavior class does not change.

The precise name for this is emergent instrumental behavior. Not consciousness. Not malice. The model reasons toward outcomes that serve the task, including deception and concealment, without being told to. At increasing levels of sophistication across every generation tested.

The security community has a name for an entity that deceives, accepts false authority, and conceals its own actions while embedded in your systems with real access. The taxonomy has not yet decided what to do when the insider is the product.

And here is where the two threads cross.

Anthropic built a model that concealed its own actions when it reasoned that concealment was strategically advantageous. They stored the documentation of that capability in a content management system where everything is public by default unless someone remembers to click a setting.

The model hid what it did. Anthropic accidentally showed everyone.

The Broader Pattern

On February 9, 2026, Mrinank Sharma, the head of Anthropic’s Safeguards Research team, posted his resignation on X. Approximately seven weeks before the March incidents.

His exact words: “Throughout my time here, I’ve repeatedly seen how hard it is to truly let our values govern our actions. I’ve seen this within myself, within the organization, where we constantly face pressures to set aside what matters most, and throughout broader society too.” Also: “The world is in peril.” He said he was leaving to move back to the UK to write poetry and “become invisible.”

Two other senior people, Harsh Mehta on the R&D (research and development) side and the leading scientist Behnam Neyshabur, announced their departures the same week. Anthropic clarified that Sharma was not “the head of safety” for the entire company, only for the Safeguards Research team specifically. That distinction matters. Sharma’s team worked on AI alignment and model safeguards, not infrastructure security. The connection between his departure and the March incidents is cultural, not operational.

But organizations where safety keeps losing to deadline pressure in one domain tend to reflect that priority structure across domains. The article cannot prove the departures caused the security failures. It can note that named insiders went on the record saying safety lost to shipping pressure, seven weeks before three things shipped that should not have.

Add the legal context. In August 2025, Anthropic settled the Bartz v. Anthropic class action for approximately $1.5 billion, the largest copyright settlement in US history. Approximately 500,000 works at approximately $3,000 per work.

Judge Alsup ruled that using legally acquired books to train AI was fair use. He denied Anthropic’s motion on piracy. Piracy was not fair use.

In January 2026, UMG, Concord, and ABKCO sued Anthropic for $3 billion over 20,000+ works, alleging Anthropic built a permanent internal library sourced from pirate repositories rather than acquiring licensed copies. Allegedly. Active lawsuit, not adjudicated. The complaint also alleges Anthropic stripped copyright management information from scraped material before ingesting it. Allegedly.

In March 2026, BMG filed a separate lawsuit alleging unauthorized use of lyrics from Bruno Mars, the Rolling Stones, Justin Bieber, and others.

The DOD (Department of Defense) designated Anthropic a supply chain risk in late February 2026, the first American company to ever receive that designation. The list it joined is Huawei, ZTE, Kaspersky, and Hikvision. Foreign adversaries. Anthropic sued and won a preliminary injunction on First Amendment grounds. The case continues.

The contradiction worth holding in mind: the federal government’s own FedRAMP (Federal Risk and Authorization Management Program) process had already cleared Anthropic for classified network access. The same federal government then designated them a supply chain risk. Both things are true, in federal court, simultaneously.

The DOD designation is not about the security incidents. It is about Anthropic refusing to remove guardrails for mass domestic surveillance and fully autonomous weapons. The connection for this piece is pattern, not causation. Same company, same time frame, multiple simultaneous compliance pressures across legal, safety, and security. An organization moving at startup velocity across every dimension at once, where the people paid to slow things down were publicly saying they kept losing the argument.

What the Palantir Contrast Tells Us

The IL6 environment held. Three things failed in five days inside the systems Anthropic controlled outright. Inside the system Palantir, DISA, and the government built and enforced, nothing failed.

When the security architecture was externally mandated and enforced, it worked. When Anthropic was solely responsible, it didn’t.

That is not an accusation. It is the pattern the incident record describes.

A firewall pointed at the wrong threat is not a security posture. It is a press release.

The Thesis

We cannot see inside Anthropic’s security program. It is possible they have a sound internal framework that failed in three isolated ways in the same month. The leaks do not prove they are not doing their job. They undermine the idea that they are. For a company asking to be trusted with critical AI infrastructure, undermining is enough.

The attacker only has to be right once. The defender has to be right every time. Defense in depth is the architecture that compensates for the gap between “has to be” and “actually is.”

Anthropic has invested heavily in safety. What the model does. How it behaves. Whether its outputs cause harm.

The incident record raises questions about security. What happens to the systems around the model. The code. The documents. The access logs that may or may not exist.

These are not the same discipline. Conflating them is how a company ends up with Constitutional AI and a default-public CMS shipping in the same product.

I depend on Claude to do my personal/private creative work. I run my pipeline on local MCPs precisely so the dependencies are smaller than the vendor relationship suggests. You do not have to stop using Claude. But you should know what you are trusting. Trust, in a security context, is not a feeling. It is a posture supported by evidence.

Safety first is not security first.