The Incident Report You Didn't Write

2026-09-17

On September 10, Anthropic published its most detailed disclosure yet on how Claude has been misused: a suspected Russia-linked espionage campaign that automated reconnaissance and malware development against more than twenty organisations, including drone manufacturers and Ukrainian officials, plus a separate set of attempts by Chinese AI firms to extract and replicate the system's capabilities.

None of those twenty-plus organisations wrote a word of that disclosure. None chose to be named in it. Most found out they were in it the same way everyone else did: by reading it. And within hours, seven AI systems around the world had already started forming an answer to the question "was this organisation compromised."

This is the part of crisis communications nobody built a playbook for.

The standard model assumes the organisation at the centre sets the pace. Something happens, you investigate, you draft a statement, you brief the press, you manage the cycle that follows. The model works because it presumes you are the one disclosing. But a growing share of reputational damage now starts somewhere else entirely: a vendor's security report, a regulator's filing, a competitor's release, a researcher's paper. You appear as a paragraph in someone else's account of events, and by the time you've read it, it has already been folded into how AI systems describe you.

Being named as a target in a nation-state espionage campaign is not an accusation of wrongdoing. It says nothing about an organisation's own security practices, and Anthropic's report is explicit that these were attacks against, not by, the named parties. But nuance rarely survives the compression. Ask an AI system six months from now about a company's security history, and "named in a state-linked espionage campaign" is exactly the kind of fact that gets flattened into a single, confident sentence, repeated the same way each time it's asked, stripped of the context that made it a story about resilience rather than exposure.

It also won't be the same sentence everywhere. A system trained primarily on Western reporting may frame the disclosure around the espionage angle Anthropic led with. A system with different training data and different incentives may lean into the distillation allegations against Chinese AI firms in the same report, or leave them out entirely. A European system may fold in questions about AI Act disclosure obligations that neither of the others raises. Same underlying event, three or more divergent narratives, and the organisations named in the middle of it had no hand in shaping any of them. Those narratives were already circulating before most comms teams finished their first internal call.

The traditional response addresses the audience that read the original report: journalists, direct stakeholders, whoever saw the story the day it broke. It says nothing about what a chatbot will tell a prospective customer, a regulator, or an investor eighteen months from now when they ask about the same event. That answer is being assembled right now, source by source, and most of the organisations it concerns have no visibility into what it currently says, let alone how it's likely to change.

The disclosures that create the most exposure are rarely the ones an organisation writes about itself. They're the ones written about it, by someone else, on a timeline the organisation doesn't set. When that happens, the first useful question isn't only "what do we say publicly." It's "what has already been said, where did each version come from, and what will these systems still be saying long after this news cycle ends." Organisations that can answer that walk into a correction, a rebuttal, or a legal demand holding a record of exactly what was claimed and when. Organisations that can't are reconstructing the story from memory, after the fact, against a version that's already had months to settle in.